Create an Elastic Endpoint rule exception list
Server:
https://{kibana_url}
- POST /api/endpoint_list
- POST /s/{space_id}/api/endpoint_list
Refer to Spaces for more information.
Create the exception list for Elastic Endpoint rule exceptions. When you create the exception list, it will have a list_id of endpoint_list. If the Elastic Endpoint exception list already exists, your request will return an empty response.
Responses
Successful response
One of:
-
_versionstring -
created_atstringrequired -
created_bystringrequired -
descriptionstringrequired -
idstring · min: 1required -
A string that does not contain only whitespace characters
-
immutablebooleanrequired -
list_idstring · min: 1required -
A string that does not contain only whitespace characters
-
metaobject -
namestringrequired -
namespace_typerequired -
Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:
single: Only available in the Kibana space in which it is created.agnostic: Available in all Kibana spaces.
-
Values:
agnosticsingle -
os_typesobject -
Values:
linuxmacoswindows -
tie_breaker_idstringrequired -
typerequired -
Values:
detectionrule_defaultendpointendpoint_trusted_appsendpoint_eventsendpoint_host_isolation_exceptionsendpoint_blocklists -
updated_atstringrequired -
updated_bystringrequired -
versioninteger · min: 1required
Invalid input data
One of:
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
-
messagestringrequired -
status_codeintegerrequired
Unsuccessful authentication
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
Insufficient privileges
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
Internal server error
-
messagestringrequired -
status_codeintegerrequired