Import an exception list
Base URL
https://{kibana_url}
POST
/api/exception_lists/_import
Auth
Import an exception list and its associated items from an NDJSON file.
Expand all
overwrite
boolean · default: false
Determines whether existing exception lists with the same list_id are overwritten.
If any exception items have the same item_id, those are also overwritten.
as_new_list
boolean · default: false
Determines whether the list being imported will have a new list_id generated.
Additional item_id's are generated for each exception item. Both the exception
list and its items are overwritten.
file
string · format: binary
A .ndjson file containing the exception list
errors
object [] required
−
Hide 4 properties
error
object required
−
Hide 2 properties
status_code
integer required
id
string · format: nonempty · min length: 1
Exception list's identifier.
item_id
string · format: nonempty · min length: 1
Human readable string identifier, e.g. trusted-linux-processes
list_id
string · format: nonempty · min length: 1
The exception list's human-readable string identifier.
For endpoint artifacts, use one of the following values:
endpoint_list: Elastic Endpoint exceptions listendpoint_trusted_apps: Trusted applications listendpoint_trusted_devices: Trusted devices listendpoint_event_filters: Event filters listendpoint_host_isolation_exceptions: Host isolation exceptions listendpoint_blocklists: Blocklist
success_count
integer · min: 0 required
success_count_exception_list_items
integer · min: 0 required
success_count_exception_lists
integer · min: 0 required
success_exception_list_items
boolean required
success_exception_lists
boolean required
400
Invalid input data response
application/json
One of:
−
Hide 2 properties
status_code
integer required
401
Unsuccessful authentication response
application/json
statusCode
integer required
403
Not enough privileges response
application/json
statusCode
integer required
500
Internal server error response
application/json
status_code
integer required
Thank you for your feedback.
Base URL
https://{kibana_url}
Examples
Request
Console
1 / 2 languages
‹
›
1
2
3
4
POST kbn:/api/exception_lists/_import
{
"file": "exception_lists.ndjson"
}
Generated from the API spec
1
2
3
4
5
6
curl -X POST "${KIBANA_URL}/api/exception_lists/_import" \
-H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: multipart/form-data" \
-d '{
"file": "exception_lists.ndjson"
}'
Generated from the API spec
Response
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{
"errors": [
{
"error": {
"message": "Error found importing exception list: Invalid value \\\u00224\\\u0022 supplied to \\\u0022list_id\\\u0022",
"status_code": 400
},
"list_id": "(unknown list_id)"
},
{
"error": {
"message": "Found that item_id: \\\u0022f7fd00bb-dba8-4c93-9d59-6cbd427b6330\\\u0022 already exists. Import of item_id: \\\u0022f7fd00bb-dba8-4c93-9d59-6cbd427b6330\\\u0022 skipped.",
"status_code": 409
},
"item_id": "f7fd00bb-dba8-4c93-9d59-6cbd427b6330",
"list_id": "7d7cccb8-db72-4667-b1f3-648efad7c1ee"
}
],
"success": "false,",
"success_count": "0,",
"success_count_exception_list_items": 0,
"success_count_exception_lists": "0,",
"success_exception_list_items": "false,",
"success_exception_lists": "false,"
}
1
2
3
4
5
{
"error": "Bad Request",
"message": "Multipart part \u0060file\u0060 is required and must contain a valid .ndjson exception list export",
"statusCode": 400
}
1
2
3
4
5
{
"error": "Unauthorized",
"message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
1
2
3
4
5
{
"error": "Forbidden",
"message": "API [POST /api/exception_lists/_import] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
"statusCode": 403
}
1
2
3
4
{
"message": "Internal Server Error",
"status_code": 500
}