Get exception lists
https://{kibana_url}
- GET /api/exception_lists/_find
- GET /s/{space_id}/api/exception_lists/_find
Refer to Spaces for more information.
Get a list of all exception lists.
Query Parameters
-
filterstring Filters the returned results according to the value of the specified field.
Uses the
so type.field name:fieldvalue syntax, whereso typecan be:exception-list: Specify a space-aware exception list.exception-list-agnostic: Specify an exception list that is shared across spaces.
-
namespace_type· default: [ "single" ] Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces (
agnosticorsingle)-
Values:
agnosticsingle -
pageinteger · min: 1 The page number to return
-
per_pageinteger · min: 1 The number of exception lists to return per page
-
sort_fieldstring Determines which field is used to sort the results
Responses
Successful response
-
dataobjectrequired -
_versionstring -
created_atstringrequired -
created_bystringrequired -
descriptionstringrequired -
idstring · min: 1required -
A string that does not contain only whitespace characters
-
immutablebooleanrequired -
list_idstring · min: 1required -
A string that does not contain only whitespace characters
-
metaobject -
namestringrequired -
namespace_typerequired -
Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:
single: Only available in the Kibana space in which it is created.agnostic: Available in all Kibana spaces.
-
Values:
agnosticsingle -
os_typesobject -
Values:
linuxmacoswindows -
tie_breaker_idstringrequired -
typerequired -
Values:
detectionrule_defaultendpointendpoint_trusted_appsendpoint_eventsendpoint_host_isolation_exceptionsendpoint_blocklists -
updated_atstringrequired -
updated_bystringrequired -
versioninteger · min: 1required -
pageinteger · min: 1required -
per_pageinteger · min: 1required -
totalinteger · min: 0required
Invalid input data response
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
-
messagestringrequired -
status_codeintegerrequired
Unsuccessful authentication response
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
Not enough privileges response
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
Internal server error response
-
messagestringrequired -
status_codeintegerrequired