Manually unassign entities from a watchlist

Base URL
https://{kibana_url}
Auth

Unassigns the provided entities from the specified watchlist. This only removes the "manual" assignment. If the entity is also assigned via other sources (for example, index or integration), it will remain on the watchlist.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

watchlist_id string required

The ID of the watchlist to remove entities from

Example: high-risk-vendors

Request body

euids string[] required

The EUIDs of the entities to unassign

Response

Unassignment successful

application/json
failed integer required

Number of entities that failed to process

items object[] required
error string

Error message if the entity failed to process

euid string required

The EUID of the entity

status enum required
Values: success failure not_found
not_found integer required

Number of entities not found in the manual watchlist assignment

successful integer required

Number of entities successfully unassigned

total integer required

Total number of entities processed

Base URL
https://{kibana_url}