Elastic Stack

Elastic Stack (ELK Stack) Security entity store API

The Security entity store API from Elastic Stack (ELK Stack) — 16 operation(s) for security entity store.

GitHub OpenAPI
Business capability
Cybersecurity Management BC-620

Operations 17

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

PUT /api/security/entity_store Change Entity Store log extraction settings · Update the Entity Store #
Ask an LLM
“Can I adjust how the Entity Store extracts entities from logs after it is installed?”
“Where is the shared log extraction configuration for entity engines updated?”
Tell an agent
Update the Entity Store log extraction configuration to {logExtraction}.
Apply log extraction settings {logExtraction} to the installed Entity Store.
GET /api/security/entity_store/entities List entities in the Entity Store · List entities #
Ask an LLM
“Which hosts, users and services has the Entity Store recorded?”
“Can I page through entity records with a cursor instead of page numbers?”
Tell an agent
List Entity Store entities of types {entity_types}, {per_page} per page.
Find entities matching filter {filterQuery} sorted by {sort_field}.
DELETE /api/security/entity_store/entities/ Delete an entity record · Delete an entity #
Ask an LLM
“How can I remove a single host or user entity from the Entity Store?”
“Is a deleted entity removed from the latest index right away?”
Tell an agent destructive · confirm first
Delete entity {entityId} from the Entity Store.
Remove the entity record with ID {entityId}.
POST /api/security/entity_store/entities/{entityType} Create an entity record · Create an entity #
Ask an LLM
“How do I add a new user or host entity to the Entity Store by hand?”
“Which entity types can I create records for?”
Tell an agent
Create a new {entityType} entity in the Entity Store.
Add a {entityType} entity record with the details I provide.
PUT /api/security/entity_store/entities/{entityType} Update one entity record · Update an entity #
Ask an LLM
“Can I edit fields on an existing host or user entity?”
“How do I overwrite protected fields on an entity record?”
Tell an agent
Update an existing {entityType} entity record with these fields.
Force-update protected fields on a {entityType} entity, force {force}.
PUT /api/security/entity_store/entities/bulk Update many entity records at once · Bulk update entities #
Ask an LLM
“Can I update a batch of entity records in a single request?”
“Does bulk entity update support forcing changes to protected fields?”
Tell an agent
Bulk update these entity records: {entities}.
Apply updates {entities} to multiple entities with force {force}.
POST /api/security/entity_store/install Install the Entity Store · Install the Entity Store #
Ask an LLM
“How do I turn on the Entity Store for hosts and users in Elastic Security?”
“Can I enable history snapshots when installing entity engines?”
Tell an agent
Install the Entity Store with engines for {entityTypes}.
Set up Entity Store engines for {entityTypes} with history snapshot {historySnapshot}.
GET /api/security/entity_store/resolution/group Show an entity's resolution group · Get resolution group #
Ask an LLM
“Which other entities have been linked to this one as the same identity?”
“Can I see every account resolved together with a given entity?”
Tell an agent
Show the resolution group for entity {entity_id}.
List all entities linked to {entity_id}.
POST /api/security/entity_store/resolution/link Link entities as the same identity · Link entities #
Ask an LLM
“How do I tell Elastic Security that several user accounts belong to the same person?”
“When do newly linked entities show up in reads?”
Tell an agent
Link entities {entity_ids} to target entity {target_id}.
Merge {entity_ids} into the resolution group of {target_id}.
GET /api/security/entity_store/resolution/rules List entity resolution rules · List entity resolution rules #
Ask an LLM
“What managed entity resolution rules exist in this space, and which are enabled?”
“Can I see the effective state of every resolution rule?”
Tell an agent
List the entity resolution rules in this space.
Show which resolution rules are currently enabled.
PUT /api/security/entity_store/resolution/rules/{id}/disable Disable an entity resolution rule · Disable an entity resolution rule #
Ask an LLM
“Can I switch off a managed resolution rule that is merging entities wrongly?”
“Does disabling a resolution rule apply only to the current space?”
Tell an agent
Disable resolution rule {id}.
Turn off entity resolution rule {id} in this space.
PUT /api/security/entity_store/resolution/rules/{id}/enable Enable an entity resolution rule · Enable an entity resolution rule #
Ask an LLM
“How do I turn a managed resolution rule back on?”
“Can I activate a resolution rule for just this space?”
Tell an agent
Enable resolution rule {id}.
Switch on entity resolution rule {id} for this space.
POST /api/security/entity_store/resolution/unlink Unlink entities from their resolution group · Unlink entities #
Ask an LLM
“How can I separate accounts that were wrongly linked as one identity?”
“Can I pull several entities out of their resolution groups at once?”
Tell an agent
Unlink entities {entity_ids} from their resolution group.
Detach {entity_ids} so they are no longer resolved together.
PUT /api/security/entity_store/start Start stopped entity engines · Start Entity Store engines #
Ask an LLM
“How do I resume entity engines I paused earlier?”
“Can I restart processing for only some entity types?”
Tell an agent
Start the entity engines for {entityTypes}.
Resume all stopped Entity Store engines.
GET /api/security/entity_store/status Check Entity Store status · Get Entity Store status #
Ask an LLM
“Is the Entity Store installed and are its engines running?”
“Can I get component-level health details for each entity engine?”
Tell an agent
Show the Entity Store status.
Get engine statuses with component health, include_components {include_components}.
PUT /api/security/entity_store/stop Stop running entity engines · Stop Entity Store engines #
Ask an LLM
“Can I pause entity engines without uninstalling the Entity Store?”
“How do I stop data processing for one entity type?”
Tell an agent
Stop the entity engines for {entityTypes}.
Pause every running Entity Store engine.
POST /api/security/entity_store/uninstall Uninstall the Entity Store · Uninstall the Entity Store #
Ask an LLM
“How do I remove the Entity Store and its engines completely?”
“Can I uninstall engines for only certain entity types?”
Tell an agent destructive · confirm first
Uninstall the Entity Store engines for {entityTypes}.
Remove the Entity Store and all its resources.

Documentation

📖
Documentation
https://www.elastic.co/docs/reference/elasticsearch
📖
APIReference
https://www.elastic.co/docs/api/doc/elasticsearch/
📖
Documentation
https://www.elastic.co/docs/reference/kibana
📖
APIReference
https://www.elastic.co/docs/api/doc/kibana/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-entity-store-api-openapi.yml

Other Resources

🔗
SourceCode
https://github.com/elastic/elasticsearch-specification
🔗
SourceCode
https://github.com/elastic/kibana
🔗
ToolCrosswalk
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/elk-stack:elk-stack-security-entity-store-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

elk-stack-security-entity-store-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  contact:
    name: Kibana Team
  description: The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
  title: Kibana Security entity store API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:


# --- truncated at 32 KB (387 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-entity-store-api-openapi.yml