Create an exception list

Base URL
https://{kibana_url}
  • POST /api/exception_lists
  • POST /s/{space_id}/api/exception_lists

Refer to Spaces for more information.

An exception list groups exception items and can be associated with detection rules. You can assign detection rules with multiple exception lists.

Note

All exception items added to the same list are evaluated using OR logic. That is, if any of the items in a list evaluate to true, the exception prevents the rule from generating an alert. Likewise, OR logic is used for evaluating exceptions when more than one exception list is assigned to a rule. To use the AND operator, you can define multiple clauses (entries) in a single exception item.

Responses

Base URL
https://{kibana_url}