Get exception list items

Base URL
https://{kibana_url}
  • GET /api/exception_lists/items/_find
  • GET /s/{space_id}/api/exception_lists/items/_find
Auth

Get a list of all exception list items in the specified list.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

list_id string[] · format: nonempty required

The list_ids of the items to fetch.

filter string[] · format: nonempty · default: []

Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax.

Example: ["exception-list.attributes.name:%My%20item"]
namespace_type enum[] · default: [ "single" ]

Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces (agnostic or single)

Values: agnostic single

Free-text search term applied to exception list item fields (for example a hostname or file path fragment).

Example: host.name
page integer · min: 0

The page number to return

per_page integer · min: 0

The number of exception list items to return per page

sort_field string · format: nonempty · min length: 1

Determines which field is used to sort the results.

Example: name
sort_order enum

Determines the sort order, which can be desc or asc.

Values: desc asc

Responses

Successful response

application/json
data object[] required
_version string

The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.

comments object[] required

Array of comment fields:

  • comment (string): Comments about the exception item.
comment string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters

created_at string · format: date-time required

Autogenerated date of object creation.

created_by string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters

id string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters

updated_at string · format: date-time

Autogenerated date of last object update.

updated_by string · format: nonempty · min length: 1

A string that does not contain only whitespace characters

created_at string · format: date-time required

Autogenerated date of object creation.

created_by string required

Autogenerated value - user that created object.

description string required

Describes the exception list.

entries union[] required
expire_time string · format: date-time

The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.

id string · format: nonempty · min length: 1 required

Exception's identifier.

item_id string · format: nonempty · min length: 1 required

Human readable string identifier, e.g. trusted-linux-processes

list_id string · format: nonempty · min length: 1 required

The exception list's human-readable string identifier.

For endpoint artifacts, use one of the following values:

  • endpoint_list: Elastic Endpoint exceptions list
  • endpoint_trusted_apps: Trusted applications list
  • endpoint_trusted_devices: Trusted devices list
  • endpoint_event_filters: Event filters list
  • endpoint_host_isolation_exceptions: Host isolation exceptions list
  • endpoint_blocklists: Blocklist
  • endpoint_custom_yara_signatures: Custom YARA signatures list
meta object
name string · format: nonempty · min length: 1 required

Exception list name.

namespace_type enum required

Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:

  • single: Only available in the Kibana space in which it is created.
  • agnostic: Available in all Kibana spaces.

For endpoint artifacts, the namespace_type must always be agnostic. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.

Values: agnostic single
os_types enum[]
Values: linux macos windows
tags string[] · format: nonempty
tie_breaker_id string required

Field used in search to ensure all containers are sorted and returned correctly.

type enum required
Values: simple
updated_at string · format: date-time required

Autogenerated date of last object update.

updated_by string required

Autogenerated value - user that last updated object.

page integer · min: 1 required
per_page integer · min: 1 required
pit string
total integer · min: 0 required

Invalid input data response

application/json
One of:
error string required
message string required
statusCode integer required

Unsuccessful authentication response

application/json
error string required
message string required
statusCode integer required

Not enough privileges response

application/json
error string required
message string required
statusCode integer required

Exception list not found response

application/json
message string required
status_code integer required

Internal server error response

application/json
message string required
status_code integer required
Base URL
https://{kibana_url}