Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Entity Analytics API

Get risk score history for an entity

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/risk_score/history</span></div>

Refer to Spaces for more information.

Returns time-ordered historical risk score entries from the risk score time-series index for a given entity.

get/api/risk_score/history

Query parameters

entity_type'host' | 'user' | 'service' | 'generic' required

The type of entity to retrieve history for.

entity_idstring required

The identifier of the entity to retrieve history for.

fromstring

Start of the time range, in date-math syntax. Defaults to 90 days ago.

tostring

End of the time range, in date-math syntax. Defaults to now.

score_type'base' | 'propagated' | 'resolution'

Filter entries by the type of score recorded (base, propagated, or resolution).

include_contributionsboolean

When true, each entry also includes the contributions recorded for that scoring run (inputs, modifiers, category 2 fields, and criticality_level), when present on the underlying document.

Response

Successful response

entity_idstring required
entity_type'host' | 'user' | 'service' | 'generic' required
intervalstring required

The effective Elasticsearch date_histogram interval expression the entries were aggregated into (for example 3h, 1d, 1w), derived from the requested time range.

Example response

{
  "entries": [
    {
      "inputs": [
        {
          "category": "category_1",
          "description": "Generated from Detection Engine Rule: Malware Prevention Alert",
          "id": "91a93376a507e86cfbf282166275b89f9dbdb1f0be6c8103c6ff2909ca8e1a1c",
          "index": ".internal.alerts-security.alerts-default-000001",
          "timestamp": "2017-07-21T17:32:28Z"
        }
      ]
    }
  ]
}