Create rule exception items
- Base URL
-
https://{kibana_url}
- POST /api/detection_engine/rules/{id}/exceptions
Create exception items that apply to a single detection rule.
Request body
Rule exception items.
-
itemsobjectrequired -
item_idstring · format: nonempty · min length: 1 -
Human readable string identifier, e.g.
trusted-linux-processes -
namespace_type -
Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:
single: Only available in the Kibana space in which it is created.agnostic: Available in all Kibana spaces.
For endpoint artifacts, the
namespace_typemust always beagnostic. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. -
Values:
agnosticsingle
Responses
Successful response
Invalid input data response
One of:
Unsuccessful authentication response
Not enough privileges response