Get Entity Store status

GET /api/security/entity_store/status
Api key auth

Spaces method and path for this operation:

get /s/{space_id}/api/security/entity_store/status

Refer to Spaces for more information.

Get the overall Entity Store status and per-engine statuses, optionally including component-level health details. Each engine reports the log extraction settings that apply to its entity type.

[Required authorization] Route required privileges: securitySolution.

Query parameters

  • include_components string | boolean

    If true, returns a detailed status of each engine including all its components.

    Values are true or false. Default value is false.

Responses

  • 200 application/json

    Indicates a successful response.

GET /api/security/entity_store/status 
curl -X GET -H "Authorization: ApiKey ${API_KEY}" \
  "${KIBANA_URL}/api/security/entity_store/status?include_components=false"

GET kbn://api/security/entity_store/status?include_components=false
Response examples (200)
The Entity Store has not been installed. 
{
  "engines": [],
  "status": "not_installed"
}
The Entity Store is running with three started engines using default settings. Each engine reports the log extraction settings for its entity type, so the default frequency is 1m for host and user, and 10m for service. 
{
  "engines": [
    {
      "delay": "1m",
      "docsPerSecond": -1,
      "enrichPolicyExecutionInterval": null,
      "fieldHistoryLength": 10,
      "filter": "",
      "frequency": "1m",
      "indexPattern": "",
      "lastExecutionTimestamp": "2026-04-10T08:30:00.000Z",
      "lookbackPeriod": "3h",
      "maxLogsPerPage": 50000,
      "maxLogsPerWindow": 100000,
      "maxLogsPerWindowCapBehavior": "drop",
      "maxPageSearchSize": 10000,
      "maxTimeWindowSize": "15m",
      "nonPriority": null,
      "status": "started",
      "timeout": "59s",
      "timestampField": "@timestamp",
      "type": "host"
    },
    {
      "delay": "1m",
      "docsPerSecond": -1,
      "enrichPolicyExecutionInterval": null,
      "fieldHistoryLength": 10,
      "filter": "",
      "frequency": "1m",
      "indexPattern": "",
      "lastExecutionTimestamp": "2026-04-10T08:30:00.000Z",
      "lookbackPeriod": "3h",
      "maxLogsPerPage": 50000,
      "maxLogsPerWindow": 100000,
      "maxLogsPerWindowCapBehavior": "defer",
      "maxPageSearchSize": 10000,
      "maxTimeWindowSize": "15m",
      "nonPriority": {
        "delay": "1m",
        "error": null,
        "fieldHistoryLength": 10,
        "frequency": "1m",
        "lastExecutionTimestamp": "2026-04-10T08:26:00.000Z",
        "lookbackPeriod": "3h",
        "maxLogsPerPage": 50000,
        "maxLogsPerWindow": 100000,
        "maxLogsPerWindowCapBehavior": "drop",
        "maxTimeWindowSize": "15m",
        "samplingRate": null,
        "status": "started",
        "timeout": "59s"
      },
      "status": "started",
      "timeout": "59s",
      "timestampField": "@timestamp",
      "type": "user"
    },
    {
      "delay": "1m",
      "docsPerSecond": -1,
      "enrichPolicyExecutionInterval": null,
      "fieldHistoryLength": 10,
      "filter": "",
      "frequency": "10m",
      "indexPattern": "",
      "lastExecutionTimestamp": "2026-04-10T08:30:00.000Z",
      "lookbackPeriod": "3h",
      "maxLogsPerPage": 50000,
      "maxLogsPerWindow": 100000,
      "maxLogsPerWindowCapBehavior": "drop",
      "maxPageSearchSize": 10000,
      "maxTimeWindowSize": "15m",
      "nonPriority": null,
      "status": "started",
      "timeout": "59s",
      "timestampField": "@timestamp",
      "type": "service"
    }
  ],
  "excludedUserNames": [],
  "status": "running"
}