Elastic Stack (ELK Stack) Security Entity Analytics API
Use the Security entity analytics APIs to manage entity analytics and risk scoring, including asset criticality, privileged user monitoring, and entity engines.
Operations 29
Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay
DELETE
/api/asset_criticality
Remove an entity's asset criticality record · Delete an asset criticality record
#
Ask an LLM
“How can I clear the criticality level I assigned to a user?”
“What happens to an entity's risk weighting when its asset criticality record is deleted?”
Tell an agent destructive · confirm first
Delete the asset criticality record for {id_field} {id_value}.
Unassign asset criticality from entity {id_value}, identified by {id_field}.
GET
/api/asset_criticality
Get an entity's asset criticality record · Get an asset criticality record
#
Ask an LLM
“What asset criticality level is assigned to a particular host or user?”
“Can I look up the criticality record for one entity by its host.name or user.name?”
Tell an agent
Get the asset criticality record for {id_field} {id_value}.
Show how critical host {id_value} is rated, matching on {id_field}.
POST
/api/asset_criticality
Set asset criticality for a single entity · Upsert an asset criticality record
#
Ask an LLM
“How do I mark one host as high impact so its risk score is weighted more?”
“Does setting criticality on an entity that already has a record overwrite the old value?”
Tell an agent
Set the asset criticality for this one entity, overwriting any existing record.
Upsert a single asset criticality record and refresh with {refresh} so it is searchable immediately.
POST
/api/asset_criticality/bulk
Bulk set asset criticality for many entities · Bulk upsert asset criticality records
#
Ask an LLM
“Can I assign criticality levels to hundreds of hosts and users in one call?”
“What is the maximum number of asset criticality records I can bulk upsert at once?”
Tell an agent
Bulk upsert these asset criticality records: {records}.
Assign criticality to all the entities in {records} in a single batch.
Ask an LLM
“Which entities have been given an asset criticality level?”
“Can I filter the criticality records with KQL and sort them by criticality level?”
Tell an agent
List asset criticality records matching {kuery}.
Page through asset criticality records sorted by {sort_field}, {per_page} per page.
DELETE
/api/entity_analytics/monitoring/engine/delete
Delete the Privilege Monitoring Engine · Delete the Privilege Monitoring Engine
#
Ask an LLM
“How do I tear down the Privilege Monitoring Engine completely?”
“Can I delete the privilege monitoring engine and also wipe the privileged user data it collected?”
Tell an agent destructive · confirm first
Delete the Privilege Monitoring Engine.
Delete the Privilege Monitoring Engine and remove its user data ({data}).
POST
/api/entity_analytics/monitoring/engine/disable
Disable the Privilege Monitoring Engine · Disable the Privilege Monitoring Engine
#
Ask an LLM
“Can I pause privileged user monitoring without losing the data it has collected?”
“What stops all Privilege Monitoring activity but keeps the monitored users?”
Tell an agent
Disable the Privilege Monitoring Engine but keep its data.
Stop privileged user monitoring for now.
POST
/api/entity_analytics/monitoring/engine/init
Initialize the Privilege Monitoring Engine · Initialize the Privilege Monitoring Engine
#
Ask an LLM
“How do I turn on Privilege Monitoring for the first time?”
“What sets up the resources the privileged user monitoring engine needs?”
Tell an agent
Initialize and start the Privilege Monitoring Engine.
Set up privileged user monitoring in this space.
POST
/api/entity_analytics/monitoring/engine/schedule_now
Run a Privilege Monitoring cycle now · Schedule the Privilege Monitoring Engine
#
Ask an LLM
“Can I force the Privilege Monitoring Engine to run immediately instead of waiting for its schedule?”
“Is there a way to trigger an immediate privileged user monitoring cycle?”
Tell an agent
Run the Privilege Monitoring Engine as soon as possible.
Trigger an immediate privileged user monitoring cycle.
GET
/api/entity_analytics/monitoring/privileges/health
Check Privilege Monitoring engine health · Health check on Privilege Monitoring
#
Ask an LLM
“Is the Privilege Monitoring Engine running, and has it hit any errors?”
“How many users is privilege monitoring currently tracking according to its health status?”
Tell an agent
Check the health of the Privilege Monitoring Engine.
Report the privileged user monitoring engine status and error details.
GET
/api/entity_analytics/monitoring/privileges/privileges
Check my permissions for Privilege Monitoring · Run a privileges check on Privilege Monitoring
#
Ask an LLM
“Do I have all the permissions required to use Privilege Monitoring?”
“Which privileges am I missing for privileged user monitoring?”
Tell an agent
Check whether my user has the permissions Privilege Monitoring needs.
Run a privileges check for privileged user monitoring.
POST
/api/entity_analytics/monitoring/users
Add a privileged user to monitoring · Create a new monitored user
#
Ask an LLM
“How do I add a single admin account to privileged user monitoring?”
“Can I start monitoring one privileged user without uploading a CSV?”
Tell an agent
Start monitoring the privileged user {user}.
Add {user} as a new monitored privileged user.
POST
/api/entity_analytics/monitoring/users/_csv
Bulk upload monitored users from a CSV · Upsert multiple monitored users via CSV upload
#
Ask an LLM
“Can I upload a CSV of privileged accounts to monitor them all at once?”
“Does the monitored-user CSV upload tell me which rows failed?”
Tell an agent
Upload {file} to upsert the privileged users it lists.
Bulk add monitored privileged users from CSV {file}.
DELETE
/api/entity_analytics/monitoring/users/{id}
Stop monitoring a privileged user · Delete a monitored user
#
Ask an LLM
“How do I remove someone from privileged user monitoring?”
“Can I delete a monitored user record by its document ID?”
Tell an agent destructive · confirm first
Remove monitored user {id} from privilege monitoring.
Delete the monitored privileged user record {id}.
PUT
/api/entity_analytics/monitoring/users/{id}
Update a monitored privileged user · Update a monitored user
#
Ask an LLM
“How do I change the labels on a user I'm already monitoring for privileged access?”
“Can I edit a monitored user's details by their document ID?”
Tell an agent
Update monitored user {id} with labels {labels}.
Edit the details of the monitored privileged user with document ID {id}.
GET
/api/entity_analytics/monitoring/users/list
List monitored privileged users · List all monitored users
#
Ask an LLM
“Which privileged users are currently being monitored?”
“Can I filter the list of monitored users with a KQL query?”
Tell an agent
List all monitored privileged users.
Show the monitored users that match {kql}.
POST
/api/entity_analytics/privileged_user_monitoring/pad/install
Install the privileged access detection package · Installs the privileged access detection package for the Entity Analytics…
#
Ask an LLM
“How do I install the privileged access detection integration and its ML modules?”
“What sets up the machine learning jobs behind privileged user monitoring?”
Tell an agent
Install the privileged access detection package.
Set up the privileged access detection ML modules for Entity Analytics.
GET
/api/entity_analytics/privileged_user_monitoring/pad/status
Check privileged access detection package status · Gets the status of the privileged access detection package for the Entity…
#
Ask an LLM
“Is the privileged access detection package installed, and are its ML jobs running?”
“What state is each privileged access detection ML job in?”
Tell an agent
Show the install status of the privileged access detection package.
Report the state of each privileged access detection ML job.
Ask an LLM
“How do I create a watchlist that raises the risk score of entities on it?”
“Can I attach entity sources when I create a new watchlist?”
Tell an agent
Create a watchlist called {name} with risk modifier {riskModifier}.
Make a new watchlist {name} described as {description} with risk modifier {riskModifier}.
Ask an LLM
“What risk modifier and description does a particular watchlist have?”
“Can I fetch one entity analytics watchlist by its ID?”
Tell an agent
Show me watchlist {id}.
Get the details of entity watchlist {id}.
PUT
/api/entity_analytics/watchlists/{id}
Update an existing watchlist · Update an existing watchlist
#
Ask an LLM
“Can I change the risk modifier on a watchlist I already created?”
“How do I rename an existing watchlist?”
Tell an agent
Rename watchlist {id} to {name} and set its risk modifier to {riskModifier}.
Update the description of watchlist {id} to {description}.
POST
/api/entity_analytics/watchlists/{watchlist_id}/csv_upload
Add entities to a watchlist from a CSV · Upload a CSV file to add entities to a watchlist
#
Ask an LLM
“Can I add a list of users and hosts to a watchlist by uploading a CSV?”
“What columns does the watchlist CSV need, like type and user.name?”
Tell an agent
Upload {file} to add its entities to watchlist {watchlist_id}.
Populate watchlist {watchlist_id} from CSV {file}.
POST
/api/entity_analytics/watchlists/{watchlist_id}/entities/assign
Manually assign entities to a watchlist · Manually assign entities to a watchlist
#
Ask an LLM
“How do I put specific entities from the entity store onto a watchlist by hand?”
“What happens if I manually assign an entity that is already on the watchlist?”
Tell an agent
Manually add entities {euids} to watchlist {watchlist_id}.
Assign {euids} to watchlist {watchlist_id} with a manual source label.
POST
/api/entity_analytics/watchlists/{watchlist_id}/entities/unassign
Manually remove entities from a watchlist · Manually unassign entities from a watchlist
#
Ask an LLM
“Can I take an entity off a watchlist that I added manually?”
“Will unassigning an entity remove it if it was also added through an index or integration source?”
Tell an agent
Remove the manual assignment of {euids} from watchlist {watchlist_id}.
Unassign entities {euids} from watchlist {watchlist_id}.
Ask an LLM
“What watchlists have been set up in entity analytics?”
“Which watchlists exist in this space?”
Tell an agent
List all my entity analytics watchlists.
Show every watchlist in this space.
DELETE
/api/risk_score/engine/dangerously_delete_data
Delete all Risk Engine data and resources · Cleanup the Risk Engine
#
Ask an LLM
“How do I completely remove the risk scoring engine, including its indices and transforms?”
“Is there a way to wipe all risk score data and start over?”
Tell an agent destructive · confirm first
Clean up the Risk Engine by deleting its indices, mappings and transforms.
Permanently remove all risk scoring engine data.
PATCH
/api/risk_score/engine/saved_object/configure
Configure the risk scoring engine · Configure the Risk Engine Saved Object
#
Ask an LLM
“Can I exclude closed alerts or certain alert tags from risk score calculations?”
“How do I change the time range the risk engine looks back over?”
Tell an agent
Configure the risk engine to ignore alerts with statuses {exclude_alert_statuses}.
Set the risk engine lookback range to {range}.
POST
/api/risk_score/engine/schedule_now
Run the risk scoring engine now · Run the risk scoring engine
#
Ask an LLM
“Can I recalculate entity risk scores right after changing asset criticality?”
“How do I trigger the risk scoring engine immediately?”
Tell an agent
Run the risk scoring engine as soon as possible.
Recalculate entity risk scores now.
GET
/api/risk_score/history
Get an entity's risk score history · Get risk score history for an entity
#
Ask an LLM
“How has a user's risk score changed over the past month?”
“Can I see which alerts contributed to each historical risk score for a host?”
Tell an agent
Show the risk score history for {entity_type} {entity_id}.
Get risk scores for {entity_type} {entity_id} from {from} to {to} with contributions.