Import an exception list

Base URL
https://{kibana_url}
  • POST /api/exception_lists/_import
  • POST /s/{space_id}/api/exception_lists/_import
Auth

Import an exception list and its associated items from an NDJSON file.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

overwrite boolean · default: false

Determines whether existing exception lists with the same list_id are overwritten. If any exception items have the same item_id, those are also overwritten.

as_new_list boolean · default: false

Determines whether the list being imported will have a new list_id generated. Additional item_id's are generated for each exception item. Both the exception list and its items are overwritten.

Request body

file string · format: binary

A .ndjson file containing the exception list

Responses

Successful response

application/json
errors object[] required
error object required
message string required
status_code integer required
id string · format: nonempty · min length: 1

Exception list's identifier.

item_id string · format: nonempty · min length: 1

Human readable string identifier, e.g. trusted-linux-processes

list_id string · format: nonempty · min length: 1

The exception list's human-readable string identifier.

For endpoint artifacts, use one of the following values:

  • endpoint_list: Elastic Endpoint exceptions list
  • endpoint_trusted_apps: Trusted applications list
  • endpoint_trusted_devices: Trusted devices list
  • endpoint_event_filters: Event filters list
  • endpoint_host_isolation_exceptions: Host isolation exceptions list
  • endpoint_blocklists: Blocklist
success boolean required
success_count integer · min: 0 required
success_count_exception_list_items integer · min: 0 required
success_count_exception_lists integer · min: 0 required
success_exception_list_items boolean required
success_exception_lists boolean required

Invalid input data response

application/json
One of:
error string required
message string required
statusCode integer required

Unsuccessful authentication response

application/json
error string required
message string required
statusCode integer required

Not enough privileges response

application/json
error string required
message string required
statusCode integer required

Internal server error response

application/json
message string required
status_code integer required
Base URL
https://{kibana_url}