Type to search.

Get exception lists

Base URL
https://{kibana_url}
  • GET /api/exception_lists/_find
  • GET /s/{space_id}/api/exception_lists/_find
Auth

Get a list of all exception lists.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

filter string

Filters the returned results according to the value of the specified field.

Uses the so type.field name:field value syntax, where so type can be:

  • exception-list: Specify a space-aware exception list.
  • exception-list-agnostic: Specify an exception list that is shared across spaces.
namespace_type enum[] · default: ["single"]

Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces (agnostic or single)

Values: agnostic single
page integer · min: 1

The page number to return

per_page integer · min: 1

The number of exception lists to return per page

sort_field string

Determines which field is used to sort the results

sort_order enum

Determines the sort order, which can be desc or asc

Values: desc asc

Responses

Successful response

application/json
data object[] required
_version string
created_at string · format: date-time required
created_by string required
description string required
id string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters

immutable boolean required
list_id string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters

meta object
name string required
namespace_type enum required

Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:

  • single: Only available in the Kibana space in which it is created.
  • agnostic: Available in all Kibana spaces.
Values: agnostic single
os_types enum[]
Values: linux macos windows
tags string[]
tie_breaker_id string required
type enum required
Values: detection rule_default endpoint endpoint_trusted_apps endpoint_events endpoint_host_isolation_exceptions endpoint_blocklists
updated_at string · format: date-time required
updated_by string required
version integer · min: 1 required
page integer · min: 1 required
per_page integer · min: 1 required
total integer · min: 0 required