Get exception lists
https://{kibana_url}
- GET /api/exception_lists/_find
- GET /s/{space_id}/api/exception_lists/_find
Refer to Spaces for more information.
Get a list of all exception list containers.
Query Parameters
-
filterstring Filters the returned results according to the value of the specified field.
Uses the
so type.field name:fieldvalue syntax, whereso typecan be:exception-list: Specify a space-aware exception list.exception-list-agnostic: Specify an exception list that is shared across spaces.
-
namespace_type· default: [ "single" ] Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces (
agnosticorsingle)-
Values:
agnosticsingle -
pageinteger · min: 1 The page number to return
-
per_pageinteger · min: 1 The number of exception lists to return per page
-
sort_fieldstring Determines which field is used to sort the results.
Responses
Successful response
-
dataobjectrequired -
_versionstring -
The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.
-
created_atstringrequired -
Autogenerated date of object creation.
-
created_bystringrequired -
Autogenerated value - user that created object.
-
descriptionstringrequired -
Describes the exception list.
-
idstring · min: 1required -
Exception list's identifier.
-
immutablebooleanrequired -
list_idstring · min: 1required -
The exception list's human-readable string identifier.
For endpoint artifacts, use one of the following values:
endpoint_list: Elastic Endpoint exceptions listendpoint_trusted_apps: Trusted applications listendpoint_trusted_devices: Trusted devices listendpoint_event_filters: Event filters listendpoint_host_isolation_exceptions: Host isolation exceptions listendpoint_blocklists: Blocklist
-
metaobject -
Placeholder for metadata about the list container.
-
namestringrequired -
The name of the exception list.
-
namespace_type -
Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:
single: Only available in the Kibana space in which it is created.agnostic: Available in all Kibana spaces.
For endpoint artifacts, the
namespace_typemust always beagnostic. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. -
Values:
agnosticsingle -
os_typesobject -
Use this field to specify the operating system. Only enter one value.
-
Values:
linuxmacoswindows -
String array containing words and phrases to help categorize exception containers.
-
tie_breaker_idstringrequired -
Field used in search to ensure all containers are sorted and returned correctly.
-
type -
The type of exception list to be created. Different list types may denote where they can be utilized.
-
Values:
detectionrule_defaultendpointendpoint_trusted_appsendpoint_trusted_devicesendpoint_eventsendpoint_host_isolation_exceptionsendpoint_blocklistsendpoint_custom_yara_signatures -
updated_atstringrequired -
Autogenerated date of last object update.
-
updated_bystringrequired -
Autogenerated value - user that last updated object.
-
versioninteger · min: 1required -
The document version, automatically increasd on updates.
-
pageinteger · min: 1required -
per_pageinteger · min: 1required -
totalinteger · min: 0required
Invalid input data response
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
-
messagestringrequired -
status_codeintegerrequired
Unsuccessful authentication response
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
Not enough privileges response
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
Internal server error response
-
messagestringrequired -
status_codeintegerrequired