Create an Elastic Endpoint rule exception list

The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.

Autogenerated date of object creation.

Autogenerated value - user that created object.

Describes the exception list.

Exception list's identifier.

The exception list's human-readable string identifier.

For endpoint artifacts, use one of the following values:

• endpoint_list: Elastic Endpoint exceptions list
• endpoint_trusted_apps: Trusted applications list
• endpoint_trusted_devices: Trusted devices list
• endpoint_event_filters: Event filters list
• endpoint_host_isolation_exceptions: Host isolation exceptions list
• endpoint_blocklists: Blocklist

Placeholder for metadata about the list container.

The name of the exception list.

Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:

• single: Only available in the Kibana space in which it is created.
• agnostic: Available in all Kibana spaces.

For endpoint artifacts, the namespace_type must always be agnostic. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.

Use this field to specify the operating system. Only enter one value.

String array containing words and phrases to help categorize exception containers.

Field used in search to ensure all containers are sorted and returned correctly.

The type of exception list to be created. Different list types may denote where they can be utilized.

Autogenerated date of last object update.

Autogenerated value - user that last updated object.