---
title: "Bulk update entities"
method: PUT
path: "/api/security/entity_store/entities/bulk"
tags: ["Security entity store"]
---

# Bulk update entities

`PUT /api/security/entity_store/entities/bulk`

**Spaces method and path for this operation:**

<div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/entities/bulk</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Update multiple entity records in the Entity Store in a single request.<br/><br/>[Required authorization] Route required privileges: securitySolution.

## Query parameters

- `force` union
  - 'true' | 'false'
  - boolean

## Headers

- `kbn-xsrf` string, required

## Request body

- object
  - `entities` object[], required — The entities to update.
    - `doc` union
      - object
        - `@timestamp` string, date-time
        - `asset` object
          - `business_unit` string
          - `criticality` union
            - 'low_impact' | 'medium_impact' | 'high_impact' | 'extreme_impact'
            - unknown
          - `environment` string
          - `id` string
          - `model` string
          - `name` string
          - `owner` string
          - `serial_number` string
          - `vendor` string
        - `entity` object
          - `attributes` object
            - `asset` boolean
            - `known_redirects` string[]
            - `managed` boolean
            - `mfa_enabled` boolean
            - `oauth_consent_restriction` string
            - `permissions` string[]
            - `storage_class` string
            - `watchlists` string[]
          - `behaviors` object
            - `anomaly_job_ids` string[]
            - `rule_names` string[]
          - `EngineMetadata` object
            - `Type` string
          - `id` string
          - `lifecycle` object
            - `first_seen` string, date-time
            - `last_activity` string, date-time
            - `last_seen` string, date-time
          - `name` string
          - `relationships` object
            - `accesses_frequently` object
              - …
            - `accesses_infrequently` object
              - …
            - `administers` object
              - …
            - `communicates_with` object
              - …
            - `depends_on` object
              - …
            - `owns` object
              - …
            - `owns_inferred` object
              - …
            - `resolution` object
              - …
            - `supervises` object
              - …
          - `risk` object
            - `calculated_level` 'Unknown' | 'Low' | 'Moderate' | 'High' | 'Critical'
            - `calculated_score` number
            - `calculated_score_norm` number
          - `schema_version` string
          - `source` string[]
          - `sub_type` string
          - `type` string
          - `url` string
        - `event` object
          - `ingested` string, date-time
        - `labels` object
        - `tags` string[]
        - `user` object
          - `domain` string[]
          - `email` string[]
          - `full_name` string[]
          - `hash` string[]
          - `id` string[]
          - `name` string
          - `risk` object
            - `calculated_level` 'Unknown' | 'Low' | 'Moderate' | 'High' | 'Critical'
            - `calculated_score` number
            - `calculated_score_norm` number
          - `roles` string[]
      - object
        - `@timestamp` string, date-time
        - `asset` object
          - `business_unit` string
          - `criticality` union
            - 'low_impact' | 'medium_impact' | 'high_impact' | 'extreme_impact'
            - unknown
          - `environment` string
          - `id` string
          - `model` string
          - `name` string
          - `owner` string
          - `serial_number` string
          - `vendor` string
        - `entity` object
          - `attributes` object
            - `asset` boolean
            - `known_redirects` string[]
            - `managed` boolean
            - `mfa_enabled` boolean
            - `oauth_consent_restriction` string
            - `permissions` string[]
            - `storage_class` string
            - `watchlists` string[]
          - `behaviors` object
            - `anomaly_job_ids` string[]
            - `rule_names` string[]
          - `EngineMetadata` object
            - `Type` string
          - `id` string
          - `lifecycle` object
            - `first_seen` string, date-time
            - `last_activity` string, date-time
            - `last_seen` string, date-time
          - `name` string
          - `relationships` object
            - `accesses_frequently` object
              - …
            - `accesses_infrequently` object
              - …
            - `administers` object
              - …
            - `communicates_with` object
              - …
            - `depends_on` object
              - …
            - `owns` object
              - …
            - `owns_inferred` object
              - …
            - `resolution` object
              - …
            - `supervises` object
              - …
          - `risk` object
            - `calculated_level` 'Unknown' | 'Low' | 'Moderate' | 'High' | 'Critical'
            - `calculated_score` number
            - `calculated_score_norm` number
          - `schema_version` string
          - `source` string[]
          - `sub_type` string
          - `type` string
          - `url` string
        - `event` object
          - `ingested` string, date-time
        - `host` object
          - `architecture` string[]
          - `domain` string[]
          - `hostname` string[]
          - `id` string[]
          - `ip` string[]
          - `mac` string[]
          - `name` string
          - `os` object
            - `family` string
            - `full` string
            - `kernel` string
            - `name` union
              - …
            - `platform` string
            - `type` union
              - …
            - `version` string
          - `risk` object
            - `calculated_level` 'Unknown' | 'Low' | 'Moderate' | 'High' | 'Critical'
            - `calculated_score` number
            - `calculated_score_norm` number
          - `type` string[]
        - `labels` object
        - `tags` string[]
      - object
        - `@timestamp` string, date-time
        - `asset` object
          - `business_unit` string
          - `criticality` union
            - 'low_impact' | 'medium_impact' | 'high_impact' | 'extreme_impact'
            - unknown
          - `environment` string
          - `id` string
          - `model` string
          - `name` string
          - `owner` string
          - `serial_number` string
          - `vendor` string
        - `entity` object
          - `attributes` object
            - `asset` boolean
            - `known_redirects` string[]
            - `managed` boolean
            - `mfa_enabled` boolean
            - `oauth_consent_restriction` string
            - `permissions` string[]
            - `storage_class` string
            - `watchlists` string[]
          - `behaviors` object
            - `anomaly_job_ids` string[]
            - `rule_names` string[]
          - `EngineMetadata` object
            - `Type` string
          - `id` string
          - `lifecycle` object
            - `first_seen` string, date-time
            - `last_activity` string, date-time
            - `last_seen` string, date-time
          - `name` string
          - `relationships` object
            - `accesses_frequently` object
              - …
            - `accesses_infrequently` object
              - …
            - `administers` object
              - …
            - `communicates_with` object
              - …
            - `depends_on` object
              - …
            - `owns` object
              - …
            - `owns_inferred` object
              - …
            - `resolution` object
              - …
            - `supervises` object
              - …
          - `risk` object
            - `calculated_level` 'Unknown' | 'Low' | 'Moderate' | 'High' | 'Critical'
            - `calculated_score` number
            - `calculated_score_norm` number
          - `schema_version` string
          - `source` string[]
          - `sub_type` string
          - `type` string
          - `url` string
        - `event` object
          - `ingested` string, date-time
        - `labels` object
        - `service` object
          - `address` string
          - `environment` string
          - `ephemeral_id` string
          - `id` string
          - `name` string
          - `node` object
            - `name` string
            - `role` string
            - `roles` string[]
          - `risk` object
            - `calculated_level` 'Unknown' | 'Low' | 'Moderate' | 'High' | 'Critical'
            - `calculated_score` number
            - `calculated_score_norm` number
          - `state` string
          - `type` string
          - `version` string
        - `tags` string[]
      - object
        - `@timestamp` string, date-time
        - `asset` object
          - `business_unit` string
          - `criticality` union
            - 'low_impact' | 'medium_impact' | 'high_impact' | 'extreme_impact'
            - unknown
          - `environment` string
          - `id` string
          - `model` string
          - `name` string
          - `owner` string
          - `serial_number` string
          - `vendor` string
        - `cloud` object
          - `account` object
            - `id` string
            - `name` string
          - `availability_zone` string
          - `instance` object
            - `id` string
            - `name` string
          - `machine` object
            - `type` string
          - `project` object
            - `id` string
            - `name` string
          - `provider` string
          - `region` string
          - `service` object
            - `name` string
        - `entity` object
          - `attributes` object
            - `asset` boolean
            - `known_redirects` string[]
            - `managed` boolean
            - `mfa_enabled` boolean
            - `oauth_consent_restriction` string
            - `permissions` string[]
            - `storage_class` string
            - `watchlists` string[]
          - `behaviors` object
            - `anomaly_job_ids` string[]
            - `rule_names` string[]
          - `EngineMetadata` object
            - `Type` string
          - `id` string
          - `lifecycle` object
            - `first_seen` string, date-time
            - `last_activity` string, date-time
            - `last_seen` string, date-time
          - `name` string
          - `relationships` object
            - `accesses_frequently` object
              - …
            - `accesses_infrequently` object
              - …
            - `administers` object
              - …
            - `communicates_with` object
              - …
            - `depends_on` object
              - …
            - `owns` object
              - …
            - `owns_inferred` object
              - …
            - `resolution` object
              - …
            - `supervises` object
              - …
          - `risk` object
            - `calculated_level` 'Unknown' | 'Low' | 'Moderate' | 'High' | 'Critical'
            - `calculated_score` number
            - `calculated_score_norm` number
          - `schema_version` string
          - `source` string[]
          - `sub_type` string
          - `type` string
          - `url` string
        - `event` object
          - `ingested` string, date-time
        - `labels` object
        - `orchestrator` object
          - `api_version` string
          - `cluster` object
            - `id` string
            - `name` string
            - `url` string
            - `version` string
          - `namespace` string
          - `organization` string
          - `resource` object
            - `annotation` string
            - `id` string
            - `ip` string
            - `label` string
            - `name` string
            - `parent` object
              - …
            - `type` string
          - `type` string
        - `tags` string[]
    - `type` 'user' | 'host' | 'service' | 'generic', required — The entity type of this record.

## Response `200`

Indicates a successful response.

## Other responses

- `400` — Bad request.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)