ELelastic
Security Entity Analytics API

Create a new watchlist

Changed on

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/watchlists</span></div>

Refer to Spaces for more information.

Creates a new entity analytics watchlist with an optional set of entity sources. Watchlists apply a risk score modifier to matched entities.

post/api/entity_analytics/watchlists

Request

  • Base URL
    https://localhost:5601
  • URL
    https://localhost:5601/api/entity_analytics/watchlists
  • Auth
    • API key in header Authorization
    • or HTTP basic

Request body

descriptionstring

Description of the watchlist

managedboolean

Indicates if the watchlist is managed by the system

namestring required

Unique name for the watchlist

riskModifiernumber required

Risk score modifier associated with the watchlist

Response

Watchlist created successfully

createdAtstring date-time

Timestamp indicating when the watchlist was created

descriptionstring

Description of the watchlist

entityCountnumber

Number of entities in the watchlist

entitySourceIdsstring[]

List of entity source IDs associated with the watchlist

hasManualEntitiesboolean

Indicates whether the watchlist contains manually assigned entities

idstring

The unique ID of the watchlist

managedboolean required

Indicates if the watchlist is managed by the system

namestring required

The name of the watchlist

riskModifiernumber required

Risk score modifier associated with the watchlist

updatedAtstring date-time

Timestamp indicating when the watchlist was last updated

Example response

{
  "createdAt": "2026-01-28T12:00:00.000Z",
  "description": "High risk vendor watchlist",
  "id": "watchlist-123",
  "managed": false,
  "name": "High Risk Vendors",
  "riskModifier": 1.5,
  "updatedAt": "2026-02-18T12:00:00.000Z"
}

Changes

  • 74b8a16b245dRevision changes
    • info

      added the optional property //// to the response with the status