Create rule exception list items

Base URL
https://{kibana_url}
  • POST /api/detection_engine/rules/{id}/exceptions
  • POST /s/{space_id}/api/detection_engine/rules/{id}/exceptions
Auth

Create exception items that apply to a single detection rule.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

id string · format: uuid required

Detection rule's identifier

Request body

Rule exception list items

items object[] required
comments object[]
comment string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters

description string required
entries union[] required
expire_time string · format: date-time
item_id string · format: nonempty · min length: 1

A string that does not contain only whitespace characters

meta object
name string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters

namespace_type enum

Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:

  • single: Only available in the Kibana space in which it is created.
  • agnostic: Available in all Kibana spaces.
Values: agnostic single
os_types enum[]
Values: linux macos windows
tags string[] · format: nonempty
type enum required
Values: simple

Responses

Successful response

application/json
<array> object[]
_version string
comments object[] required
comment string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters

created_at string · format: date-time required
created_by string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters

id string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters

updated_at string · format: date-time
updated_by string · format: nonempty · min length: 1

A string that does not contain only whitespace characters

created_at string · format: date-time required
created_by string required
description string required
entries union[] required
expire_time string · format: date-time
id string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters

item_id string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters

list_id string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters

meta object
name string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters

namespace_type enum required

Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:

  • single: Only available in the Kibana space in which it is created.
  • agnostic: Available in all Kibana spaces.
Values: agnostic single
os_types enum[]
Values: linux macos windows
tags string[] · format: nonempty
tie_breaker_id string required
type enum required
Values: simple
updated_at string · format: date-time required
updated_by string required

Invalid input data response

application/json
One of:
error string required
message string required
statusCode integer required

Unsuccessful authentication response

application/json
error string required
message string required
statusCode integer required

Not enough privileges response

application/json
error string required
message string required
statusCode integer required

Internal server error response

application/json
message string required
status_code integer required
Base URL
https://{kibana_url}