---
title: "Finds Knowledge Base Entries that match the given query."
method: GET
path: "/api/security_ai_assistant/knowledge_base/entries/_find"
tags: ["Security AI Assistant API"]
---

# Finds Knowledge Base Entries that match the given query.

`GET /api/security_ai_assistant/knowledge_base/entries/_find`

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/knowledge_base/entries/_find</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Finds Knowledge Base Entries that match the given query.

## Query parameters

- `fields` string[]
- `filter` string
- `sort_field` 'created_at' | 'is_default' | 'title' | 'updated_at' — Fields available for sorting Knowledge Base Entries.
- `sort_order` 'asc' | 'desc' — The order in which results are sorted.
- `page` integer
- `per_page` integer

## Response `200`

Successful response containing the paginated Knowledge Base Entries.

- object
  - `data` SecurityAIAssistantAPIKnowledgeBaseEntryResponse[], required — The list of Knowledge Base Entries for the current page.
    - union
      - SecurityAIAssistantAPIDocumentEntry
        - `global` boolean, required — Whether this Knowledge Base Entry is global, defaults to false.
        - `name` string, required — Name of the Knowledge Base Entry.
        - `namespace` string, required — Kibana Space, defaults to 'default' space.
        - `users` SecurityAIAssistantAPIUser[], required — Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
          - `id` string — User id.
          - `name` string — User name.
        - `createdAt` string, required — Time the Knowledge Base Entry was created.
        - `createdBy` string, required — User who created the Knowledge Base Entry.
        - `id` string, nonempty, required — A string that does not contain only whitespace characters.
        - `updatedAt` string, required — Time the Knowledge Base Entry was last updated.
        - `updatedBy` string, required — User who last updated the Knowledge Base Entry.
        - `kbResource` 'security_labs' | 'defend_insights' | 'user', required — Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.
        - `source` string, required — Source document name or filepath.
        - `text` string, required — Knowledge Base Entry content.
        - `type` 'document', required — Entry type.
        - `required` boolean — Whether this resource should always be included, defaults to false.
        - `vector` SecurityAIAssistantAPIVector — Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.
          - `modelId` string, required — ID of the model used to create the embeddings.
          - `tokens` object, required — Tokens with their corresponding values.
      - SecurityAIAssistantAPIIndexEntry
        - `global` boolean, required — Whether this Knowledge Base Entry is global, defaults to false.
        - `name` string, required — Name of the Knowledge Base Entry.
        - `namespace` string, required — Kibana Space, defaults to 'default' space.
        - `users` SecurityAIAssistantAPIUser[], required — Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
          - `id` string — User id.
          - `name` string — User name.
        - `createdAt` string, required — Time the Knowledge Base Entry was created.
        - `createdBy` string, required — User who created the Knowledge Base Entry.
        - `id` string, nonempty, required — A string that does not contain only whitespace characters.
        - `updatedAt` string, required — Time the Knowledge Base Entry was last updated.
        - `updatedBy` string, required — User who last updated the Knowledge Base Entry.
        - `description` string, required — Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.
        - `field` string, required — Field to query for Knowledge Base content.
        - `index` string, required — Index or Data Stream to query for Knowledge Base content.
        - `queryDescription` string, required — Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.
        - `type` 'index', required — Entry type.
        - `inputSchema` object[] — Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.
          - `description` string, required — Description of the field.
          - `fieldName` string, required — Name of the field.
          - `fieldType` string, required — Type of the field.
        - `outputFields` string[] — Fields to extract from the query result, defaults to all fields if not provided or empty.
  - `page` integer, required — The current page number.
  - `perPage` integer, required — The number of Knowledge Base Entries returned per page.
  - `total` integer, required — The total number of Knowledge Base Entries available.

## Other responses

- `400` — Bad Request response.

---

[API](https://skmtc.dev/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.dev/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/elastic/kibana-apis/revisions/a96230d7e670/schema)