Create an exception list

Base URL
https://{kibana_url}
  • POST /api/exception_lists
  • POST /s/{space_id}/api/exception_lists
Auth

An exception list groups exception items and can be associated with detection rules. You can assign detection rules with multiple exception lists.

Note

All exception items added to the same list are evaluated using OR logic. That is, if any of the items in a list evaluate to true, the exception prevents the rule from generating an alert. Likewise, OR logic is used for evaluating exceptions when more than one exception list is assigned to a rule. To use the AND operator, you can define multiple clauses (entries) in a single exception item.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

Exception list's properties

description string required
list_id string · format: nonempty · min length: 1

A string that does not contain only whitespace characters

meta object
name string required
namespace_type enum

Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:

  • single: Only available in the Kibana space in which it is created.
  • agnostic: Available in all Kibana spaces.
Values: agnostic single
os_types enum[]
Values: linux macos windows
tags string[]
type enum required
Values: detection rule_default endpoint endpoint_trusted_apps endpoint_events endpoint_host_isolation_exceptions endpoint_blocklists
version integer · min: 1

Responses

Successful response

application/json
_version string
created_at string · format: date-time required
created_by string required
description string required
id string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters

immutable boolean required
list_id string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters

meta object
name string required
namespace_type enum required

Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:

  • single: Only available in the Kibana space in which it is created.
  • agnostic: Available in all Kibana spaces.
Values: agnostic single
os_types enum[]
Values: linux macos windows
tags string[]
tie_breaker_id string required
type enum required
Values: detection rule_default endpoint endpoint_trusted_apps endpoint_events endpoint_host_isolation_exceptions endpoint_blocklists
updated_at string · format: date-time required
updated_by string required
version integer · min: 1 required

Invalid input data response

application/json
One of:
error string required
message string required
statusCode integer required

Unsuccessful authentication response

application/json
error string required
message string required
statusCode integer required

Not enough privileges response

application/json
error string required
message string required
statusCode integer required

Exception list already exists response

application/json
message string required
status_code integer required

Internal server error response

application/json
message string required
status_code integer required
Base URL
https://{kibana_url}