Create an exception list

Server: https://{kibana_url}
  • POST /api/exception_lists
  • POST /s/{space_id}/api/exception_lists
Api key auth Basic auth

Refer to Spaces for more information.

An exception list groups exception items and can be associated with detection rules. You can assign detection rules with multiple exception lists.

info All exception items added to the same list are evaluated using OR logic. That is, if any of the items in a list evaluate to true, the exception prevents the rule from generating an alert. Likewise, OR logic is used for evaluating exceptions when more than one exception list is assigned to a rule. To use the AND operator, you can define multiple clauses (entries) in a single exception item.

Responses