Get exception list items
https://{kibana_url}
- GET /api/exception_lists/items/_find
Get a list of all exception list items in the specified list.
Query Parameters
-
list_idstringrequired The
list_ids of the items to fetch.-
filterstring · default: [] Filters the returned results according to the value of the specified field, using the
<field name>:<field value>syntax.-
namespace_type· default: [ "single" ] Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces (
agnosticorsingle)-
Values:
agnosticsingle -
searchstring Free-text search term applied to exception list item fields (for example a hostname or file path fragment).
-
pageinteger · min: 0 The page number to return
-
per_pageinteger · min: 0 The number of exception list items to return per page
-
sort_fieldstring · min: 1 Determines which field is used to sort the results.
Responses
Successful response
-
dataobjectrequired -
_versionstring -
The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.
-
commentsobjectrequired -
Array of comment fields:
- comment (string): Comments about the exception item.
-
commentstring · min: 1required -
A string that does not contain only whitespace characters
-
created_atstringrequired -
Autogenerated date of object creation.
-
created_bystring · min: 1required -
A string that does not contain only whitespace characters
-
idstring · min: 1required -
A string that does not contain only whitespace characters
-
updated_atstring -
Autogenerated date of last object update.
-
updated_bystring · min: 1 -
A string that does not contain only whitespace characters
-
created_atstringrequired -
Autogenerated date of object creation.
-
created_bystringrequired -
Autogenerated value - user that created object.
-
descriptionstringrequired -
Describes the exception list.
-
entriesobjectrequired -
expire_timestring -
The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
-
idstring · min: 1required -
Exception's identifier.
-
item_idstring · min: 1required -
Human readable string identifier, e.g.
trusted-linux-processes -
list_idstring · min: 1required -
The exception list's human-readable string identifier.
For endpoint artifacts, use one of the following values:
endpoint_list: Elastic Endpoint exceptions listendpoint_trusted_apps: Trusted applications listendpoint_trusted_devices: Trusted devices listendpoint_event_filters: Event filters listendpoint_host_isolation_exceptions: Host isolation exceptions listendpoint_blocklists: Blocklist
-
metaobject -
namestring · min: 1required -
Exception list name.
-
namespace_type -
Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:
single: Only available in the Kibana space in which it is created.agnostic: Available in all Kibana spaces.
For endpoint artifacts, the
namespace_typemust always beagnostic. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. -
Values:
agnosticsingle -
os_typesobject -
Values:
linuxmacoswindows -
tie_breaker_idstringrequired -
Field used in search to ensure all containers are sorted and returned correctly.
-
type -
Values:
simple -
updated_atstringrequired -
Autogenerated date of last object update.
-
updated_bystringrequired -
Autogenerated value - user that last updated object.
-
pageinteger · min: 1required -
per_pageinteger · min: 1required -
pitstring -
totalinteger · min: 0required
Invalid input data response
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
-
messagestringrequired -
status_codeintegerrequired
Unsuccessful authentication response
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
Not enough privileges response
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
Exception list not found response
-
messagestringrequired -
status_codeintegerrequired
Internal server error response
-
messagestringrequired -
status_codeintegerrequired