Get exception list items
- Base URL
-
https://{kibana_url}
- GET /api/exception_lists/items/_find
Get a list of all exception list items in the specified list.
Query parameters
-
filterstring · format: nonempty · default: [] -
Filters the returned results according to the value of the specified field, using the
<field name>:<field value>syntax. -
Example:
["exception-list.attributes.name:%My%20item"] -
namespace_type· default: [ "single" ] -
Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces (
agnosticorsingle) -
Values:
agnosticsingle -
searchstring -
Free-text search term applied to exception list item fields (for example a hostname or file path fragment).
-
Example:
host.name
Responses
Successful response
-
dataobjectrequired -
_versionstring -
The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.
-
commentsobjectrequired -
Array of comment fields:
- comment (string): Comments about the exception item.
-
expire_timestring · format: date-time -
The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
-
item_idstring · format: nonempty · min length: 1required -
Human readable string identifier, e.g.
trusted-linux-processes -
list_idstring · format: nonempty · min length: 1required -
The exception list's human-readable string identifier.
For endpoint artifacts, use one of the following values:
endpoint_list: Elastic Endpoint exceptions listendpoint_trusted_apps: Trusted applications listendpoint_trusted_devices: Trusted devices listendpoint_event_filters: Event filters listendpoint_host_isolation_exceptions: Host isolation exceptions listendpoint_blocklists: Blocklist
-
namespace_typerequired -
Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:
single: Only available in the Kibana space in which it is created.agnostic: Available in all Kibana spaces.
For endpoint artifacts, the
namespace_typemust always beagnostic. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. -
Values:
agnosticsingle
Invalid input data response
Unsuccessful authentication response
Not enough privileges response
Exception list not found response