Security entity store

Install the Entity Store

Changed on

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/install</span></div>

Refer to Spaces for more information.

Install the Entity Store and create engines for the specified entity types. logExtraction sets overrides that apply to all entity types, on top of built-in defaults per entity type. The default frequency is 1m for host and user, 10m for service and 30m for generic. Supply it once at install to customize settings; omit it (or send an empty object) to use defaults on first install or preserve the existing configuration on re-install. Omitting a field leaves it unchanged. Sending null for a field clears that override and reverts to the entity type default. To change settings after install, use the update endpoint.<br/><br/>[Required authorization] Route required privileges: securitySolution.

post/api/security/entity_store/install

Request

  • Base URL
    https://localhost:5601
  • URL
    https://localhost:5601/api/security/entity_store/install
  • Auth
    • API key in header Authorization
    • or HTTP basic

Headers

kbn-xsrfstring required
Example:true

A required header to protect against CSRF attacks

Request body

entityTypesstring[]
excludedUserNamesstring[]

Response

Indicates all requested entity types are already installed.

Changes

  • 9d17cb2c40a6Revision changes
    • info

      the request property / became nullable

    • info

      the request property / became nullable

    • info

      the request property / became nullable

    • info

      the request property / became nullable

    • info

      the request property / became nullable

    • info

      the request property / became nullable

    • info

      the request property / became nullable

    • info

      the request property / became nullable

    • info

      the request property / became nullable

    • info

      the request property / became nullable

    • info

      the request property / became nullable

  • cb4c6440bd85Revision changes
    • info

      the request property default value was removed

    • info

      the request property default value 1m was removed

    • info

      the request property default value 10000 was removed

    • info

      the request property default value was removed

    • info

      the request property default value 10 was removed

    • info

      the request property default value 1m was removed

    • info

      the request property default value 3h was removed

    • info

      the request property default value 50000 was removed

    • info

      the request property default value 100000 was removed

    • info

      the request property default value drop was removed

    • info

      the request property default value 15m was removed