Update a monitored user

PUT /api/entity_analytics/monitoring/users/{id}

Api key auth Basic auth

Path parameters

id string Required

application/json

Body Required

@timestamp string(date-time)
entity_analytics_monitoring object
Hide entity_analytics_monitoring attribute Show entity_analytics_monitoring attribute object
- labels array[object]
  Hide labels attributes Show labels attributes object
  
  field string
  
  source string
  
  value string
event object
Hide event attribute Show event attribute object
- ingested string(date-time)
id string
labels object
Hide labels attributes Show labels attributes object
- monitoring object
  Hide monitoring attribute Show monitoring attribute object
  
  privileged_users string
  
  Values are monitored or deleted.
- source_indices array[string]
- source_integrations array[string]
- sources array
  
  Values are csv, index_sync, or api.
user object
Hide user attribute Show user attribute object
- name string

Responses

200 application/json

User updated successfully
Hide response attributes Show response attributes object
- @timestamp string(date-time)
- entity_analytics_monitoring object
  
  Hide entity_analytics_monitoring attribute Show entity_analytics_monitoring attribute object
  
  labels array[object]
  
  Hide labels attributes Show labels attributes object
  
  field string
  
  source string
  
  value string
- event object
  
  Hide event attribute Show event attribute object
  
  ingested string(date-time)
- id string
- labels object
  
  Hide labels attributes Show labels attributes object
  
  monitoring object
  
  Hide monitoring attribute Show monitoring attribute object
  
  privileged_users string
  
  Values are monitored or deleted.
  
  source_indices array[string]
  
  source_integrations array[string]
  
  sources array
  
  Values are csv, index_sync, or api.
- user object
  
  Hide user attribute Show user attribute object
  
  name string

PUT /api/entity_analytics/monitoring/users/{id}

curl \
 --request PUT 'https://localhost:5601/api/entity_analytics/monitoring/users/{id}' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{"@timestamp":"2025-05-04T09:42:00Z","entity_analytics_monitoring":{"labels":[{"field":"string","source":"string","value":"string"}]},"event":{"ingested":"2025-05-04T09:42:00Z"},"id":"string","labels":{"monitoring":{"privileged_users":"monitored"},"source_indices":["string"],"source_integrations":["string"],"sources":["csv"]},"user":{"name":"string"}}'