Create rule exception list items
https://{kibana_url}
- POST /api/detection_engine/rules/{id}/exceptions
- POST /s/{space_id}/api/detection_engine/rules/{id}/exceptions
Refer to Spaces for more information.
Create exception items that apply to a single detection rule.
Path Parameters
-
idstringrequired -
Detection rule's identifier
Request
Rule exception list items
-
itemsobjectrequired -
commentsobject -
commentstring · min: 1required -
A string that does not contain only whitespace characters
-
descriptionstringrequired -
entriesobjectrequired -
expire_timestring -
item_idstring · min: 1 -
A string that does not contain only whitespace characters
-
metaobject -
namestring · min: 1required -
A string that does not contain only whitespace characters
-
namespace_type -
Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:
single: Only available in the Kibana space in which it is created.agnostic: Available in all Kibana spaces.
-
Values:
agnosticsingle -
os_typesobject -
Values:
linuxmacoswindows -
typerequired -
Values:
simple
Responses
Successful response
Response Type: object
-
_versionstring -
commentsobjectrequired -
commentstring · min: 1required -
A string that does not contain only whitespace characters
-
created_atstringrequired -
created_bystring · min: 1required -
A string that does not contain only whitespace characters
-
idstring · min: 1required -
A string that does not contain only whitespace characters
-
updated_atstring -
updated_bystring · min: 1 -
A string that does not contain only whitespace characters
-
created_atstringrequired -
created_bystringrequired -
descriptionstringrequired -
entriesobjectrequired -
expire_timestring -
idstring · min: 1required -
A string that does not contain only whitespace characters
-
item_idstring · min: 1required -
A string that does not contain only whitespace characters
-
list_idstring · min: 1required -
A string that does not contain only whitespace characters
-
metaobject -
namestring · min: 1required -
A string that does not contain only whitespace characters
-
namespace_typerequired -
Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:
single: Only available in the Kibana space in which it is created.agnostic: Available in all Kibana spaces.
-
Values:
agnosticsingle -
os_typesobject -
Values:
linuxmacoswindows -
tie_breaker_idstringrequired -
typerequired -
Values:
simple -
updated_atstringrequired -
updated_bystringrequired
Invalid input data response
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
-
messagestringrequired -
status_codeintegerrequired
Unsuccessful authentication response
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
Not enough privileges response
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
Internal server error response
-
messagestringrequired -
status_codeintegerrequired