Get Elastic Endpoint exception list items
https://{kibana_url}
- GET /api/endpoint_list/items/_find
Get a list of all Elastic Endpoint exception list items.
Query Parameters
-
filterstring · min: 1 Filters the returned results according to the value of the specified field, using the
<field name>:<field value>syntax.-
pageinteger · min: 0 The page number to return
-
per_pageinteger · min: 0 The number of exception list items to return per page
-
sort_fieldstring · min: 1 Determines which field is used to sort the results
Responses
Successful response
-
dataobjectrequired -
The list of endpoint exception list items.
-
_versionstring -
The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.
-
commentsobjectrequired -
Array of comment fields:
- comment (string): Comments about the exception item.
-
commentstring · min: 1required -
A string that does not contain only whitespace characters
-
created_atstringrequired -
Autogenerated date of object creation.
-
created_bystring · min: 1required -
A string that does not contain only whitespace characters
-
idstring · min: 1required -
A string that does not contain only whitespace characters
-
updated_atstring -
Autogenerated date of last object update.
-
updated_bystring · min: 1 -
A string that does not contain only whitespace characters
-
created_atstringrequired -
Autogenerated date of object creation.
-
created_bystringrequired -
Autogenerated value - user that created object.
-
descriptionstringrequired -
Describes the exception list.
-
entriesobjectrequired -
expire_timestring -
The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
-
idstring · min: 1required -
Exception's identifier.
-
item_idstring · min: 1required -
Human readable string identifier, e.g.
trusted-linux-processes -
list_idstring · min: 1required -
The exception list's human-readable string identifier.
For endpoint artifacts, use one of the following values:
endpoint_list: Elastic Endpoint exceptions listendpoint_trusted_apps: Trusted applications listendpoint_trusted_devices: Trusted devices listendpoint_event_filters: Event filters listendpoint_host_isolation_exceptions: Host isolation exceptions listendpoint_blocklists: Blocklist
-
metaobject -
namestring · min: 1required -
Exception list name.
-
namespace_type -
Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:
single: Only available in the Kibana space in which it is created.agnostic: Available in all Kibana spaces.
For endpoint artifacts, the
namespace_typemust always beagnostic. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. -
Values:
agnosticsingle -
os_typesobject -
Values:
linuxmacoswindows -
tie_breaker_idstringrequired -
Field used in search to ensure all containers are sorted and returned correctly.
-
type -
Values:
simple -
updated_atstringrequired -
Autogenerated date of last object update.
-
updated_bystringrequired -
Autogenerated value - user that last updated object.
-
pageinteger · min: 0required -
The current page number.
-
per_pageinteger · min: 0required -
The number of items per page.
-
pitstring -
The point-in-time ID for pagination.
-
totalinteger · min: 0required -
The total number of endpoint exception list items.
Invalid input data
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
-
messagestringrequired -
status_codeintegerrequired
Unsuccessful authentication
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
Insufficient privileges
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
Endpoint list not found
-
messagestringrequired -
status_codeintegerrequired
Internal server error
-
messagestringrequired -
status_codeintegerrequired