Get a metadata list

GET /api/endpoint/metadata
Api key auth

Query parameters

  • page integer

    Page number

    Minimum value is 1. Default value is 1.

  • pageSize integer

    Number of items per page

    Minimum value is 1, maximum value is 100. Default value is 10.

  • kuery string

    A KQL string.

  • hostStatuses array[string] Required

    A set of agent health statuses to filter by.

    Values are healthy, offline, updating, inactive, or unenrolled.

  • sortField string

    Determines which field is used to sort the results.

    Values are enrolled_at, metadata.host.hostname, host_status, metadata.Endpoint.policy.applied.name, metadata.Endpoint.policy.applied.status, metadata.host.os.name, metadata.host.ip, metadata.agent.version, or last_checkin.

  • sortDirection string

    Determines the sort order.

    Values are asc or desc.

Responses

  • 200 application/json

    OK
GET /api/endpoint/metadata 
curl \ --request GET 'https://<KIBANA_URL>/api/endpoint/metadata?hostStatuses=healthy&hostStatuses=updating' \ --header "Authorization: $API_KEY"
Response examples (200) 
{ "data": [ { "metadata": { "ecs": { "version": "1.11.0" }, "host": { "id": "0cfead88e2024bd8a27476352b5ab264", "ip": [ "127.0.0.1", "::1", "10.0.2.15", "fe80::2ac7:8e15:b957:2fa1" ], "os": { "Ext": { "variant": "Ubuntu" }, "full": "Ubuntu 20.04.2", "name": "Linux", "type": "linux", "family": "ubuntu", "kernel": "5.8.0-59-generic #66~20.04.1-Ubuntu SMP Thu Jun 17 11:14:10 UTC 2021", "version": "20.04.2", "platform": "ubuntu" }, "mac": [ "08:00:27:e6:78:8b" ], "name": "david-Xubuntu", "hostname": "david-Xubuntu", "architecture": "x86_64" }, "agent": { "id": "285297c6-3bff-4b83-9a07-f3e749801123", "type": "endpoint", "build": { "original": "version: 7.16.0, compiled: Tue Nov 16 16:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab" }, "version": "7.16.0" }, "event": { "id": "MNtSXK/SkhEBnmgt++++++7S", "kind": "metric", "type": [ "info" ], "action": "endpoint_metadata", "module": "endpoint", "created": "2023-07-04T15:47:57.432173535Z", "dataset": "endpoint.metadata", "category": [ "host" ], "ingested": "2023-07-04T15:47:58Z", "sequence": 400, "agent_id_status": "verified" }, "elastic": { "agent": { "id": "285297c6-3bff-4b83-9a07-f3e749801123" } }, "message": "Endpoint metadata", "Endpoint": { "state": { "isolation": false }, "policy": { "applied": { "id": "d5371dcd-93b7-4627-af88-4084f7d6aa3e", "name": "test", "status": "success", "version": "3", "endpoint_policy_version": "2" } }, "status": "enrolled", "capabilities": [ "isolation" ], "configuration": { "isolation": false } }, "@timestamp": "2023-07-04T15:47:57.432173535Z", "data_stream": { "type": "metrics", "dataset": "endpoint.metadata", "namespace": "default" } }, "host_status": "healthy", "policy_info": { "agent": { "applied": { "id": "ed7e3720-4bad-11ec-a2a8-fb22e62a5753", "revision": 0 }, "configured": { "id": "ed7e3720-4bad-11ec-a2a8-fb22e62a5753", "revision": 3 } }, "endpoint": { "id": "d5371dcd-93b7-4627-af88-4084f7d6aa3e", "revision": 2 } }, "last_checkin": "2023-07-04T15:47:57.432Z" }, { "metadata": { "ecs": { "version": "1.11.0" }, "host": { "id": "17d9cabc-7edd-43bc-bacb-8da5f5e6c0e5", "ip": [ "10.0.2.15", "fe80::21a6:63d3:d70e:e3ad", "127.0.0.1", "::1" ], "os": { "Ext": { "variant": "Windows 10 Enterprise Evaluation" }, "full": "Windows 10 Enterprise Evaluation 20H2 (10.0.19042.906)", "name": "Windows", "type": "windows", "family": "windows", "kernel": "20H2 (10.0.19042.906)", "version": "20H2 (10.0.19042.906)", "platform": "windows" }, "mac": [ "08:00:27:b1:1d:5a" ], "name": "WinDev2104Eval", "hostname": "WinDev2104Eval", "architecture": "x86_64" }, "agent": { "id": "abb8a826-6812-448c-a571-6d8269b51449", "type": "endpoint", "build": { "original": "version: 7.16.0, compiled: Tue Nov 16 17:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab" }, "version": "7.16.0" }, "event": { "id": "MNtRc++KoKHXXwlj+++++/N9", "kind": "metric", "type": [ "info" ], "action": "endpoint_metadata", "module": "endpoint", "created": "2023-07-04T15:44:31.4917849Z", "dataset": "endpoint.metadata", "category": [ "host" ], "ingested": "2023-07-04T15:44:33Z", "sequence": 5159, "agent_id_status": "verified" }, "elastic": { "agent": { "id": "abb8a826-6812-448c-a571-6d8269b51449" } }, "message": "Endpoint metadata", "Endpoint": { "state": { "isolation": false }, "policy": { "applied": { "id": "d5371dcd-93b7-4627-af88-4084f7d6aa3e", "name": "test", "status": "success", "version": "3", "endpoint_policy_version": "2" } }, "status": "enrolled", "capabilities": [ "isolation" ], "configuration": { "isolation": false } }, "@timestamp": "2023-07-04T15:44:31.4917849Z", "data_stream": { "type": "metrics", "dataset": "endpoint.metadata", "namespace": "default" } }, "host_status": "healthy", "policy_info": { "agent": { "applied": { "id": "ed7e3720-4bad-11ec-a2a8-fb22e62a5753", "revision": 0 }, "configured": { "id": "ed7e3720-4bad-11ec-a2a8-fb22e62a5753", "revision": 3 } }, "endpoint": { "id": "d5371dcd-93b7-4627-af88-4084f7d6aa3e", "revision": 2 } }, "last_checkin": "2023-07-04T15:44:31.491Z" } ], "page": 0, "total": 2, "pageSize": 10, "sortField": "enrolled_at", "sortDirection": "desc" }