Type to search.

Create a shared exception list

Base URL
https://{kibana_url}
  • POST /api/exceptions/shared
  • POST /s/{space_id}/api/exceptions/shared
Auth

An exception list groups exception items and can be associated with detection rules. A shared exception list can apply to multiple detection rules.

Note

All exception items added to the same list are evaluated using OR logic. That is, if any of the items in a list evaluate to true, the exception prevents the rule from generating an alert. Likewise, OR logic is used for evaluating exceptions when more than one exception list is assigned to a rule. To use the AND operator, you can define multiple clauses (entries) in a single exception item.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

description string required
name string required

Responses

Successful response

application/json
_version string
created_at string · format: date-time required
created_by string required
description string required
id string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters

immutable boolean required
list_id string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters

meta object
name string required
namespace_type enum required

Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:

  • single: Only available in the Kibana space in which it is created.
  • agnostic: Available in all Kibana spaces.
Values: agnostic single
os_types enum[]
Values: linux macos windows
tags string[]
tie_breaker_id string required
type enum required
Values: detection rule_default endpoint endpoint_trusted_apps endpoint_events endpoint_host_isolation_exceptions endpoint_blocklists
updated_at string · format: date-time required
updated_by string required
version integer · min: 1 required