Create a shared exception list

Base URL
https://{kibana_url}
  • POST /api/exceptions/shared
  • POST /s/{space_id}/api/exceptions/shared

Refer to Spaces for more information.

An exception list groups exception items and can be associated with detection rules. A shared exception list can apply to multiple detection rules.

Note

All exception items added to the same list are evaluated using OR logic. That is, if any of the items in a list evaluate to true, the exception prevents the rule from generating an alert. Likewise, OR logic is used for evaluating exceptions when more than one exception list is assigned to a rule. To use the AND operator, you can define multiple clauses (entries) in a single exception item.

Responses

Base URL
https://{kibana_url}