Type to search.

Get exception lists

Base URL
https://{kibana_url}
  • GET /api/exception_lists/_find
  • GET /s/{space_id}/api/exception_lists/_find
Auth

Get a list of all exception list containers.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

filter string

Filters the returned results according to the value of the specified field.

Uses the so type.field name:field value syntax, where so type can be:

  • exception-list: Specify a space-aware exception list.
  • exception-list-agnostic: Specify an exception list that is shared across spaces.
Example: exception-list.attributes.name:%Detection%20List
namespace_type enum[] · default: ["single"]

Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces (agnostic or single)

Values: agnostic single
page integer · min: 1

The page number to return

per_page integer · min: 1

The number of exception lists to return per page

sort_field string

Determines which field is used to sort the results.

Example: name
sort_order enum

Determines the sort order, which can be desc or asc.

Values: desc asc

Responses

Successful response

application/json
data object[] required
_version string

The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.

created_at string · format: date-time required

Autogenerated date of object creation.

created_by string required

Autogenerated value - user that created object.

description string required

Describes the exception list.

id string · format: nonempty · min length: 1 required

Exception list's identifier.

immutable boolean required
list_id string · format: nonempty · min length: 1 required

The exception list's human-readable string identifier.

For endpoint artifacts, use one of the following values:

  • endpoint_list: Elastic Endpoint exceptions list
  • endpoint_trusted_apps: Trusted applications list
  • endpoint_trusted_devices: Trusted devices list
  • endpoint_event_filters: Event filters list
  • endpoint_host_isolation_exceptions: Host isolation exceptions list
  • endpoint_blocklists: Blocklist
  • endpoint_custom_yara_signatures: Custom YARA signatures list
meta object

Placeholder for metadata about the list container.

name string required

The name of the exception list.

namespace_type enum required

Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:

  • single: Only available in the Kibana space in which it is created.
  • agnostic: Available in all Kibana spaces.

For endpoint artifacts, the namespace_type must always be agnostic. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.

Values: agnostic single
os_types enum[]

Use this field to specify the operating system. Only enter one value.

Values: linux macos windows
tags string[]

String array containing words and phrases to help categorize exception containers.

tie_breaker_id string required

Field used in search to ensure all containers are sorted and returned correctly.

type enum required

The type of exception list to be created. Different list types may denote where they can be utilized.

Values: detection rule_default endpoint endpoint_trusted_apps endpoint_trusted_devices endpoint_events endpoint_host_isolation_exceptions endpoint_blocklists endpoint_custom_yara_signatures
updated_at string · format: date-time required

Autogenerated date of last object update.

updated_by string required

Autogenerated value - user that last updated object.

version integer · min: 1 required

The document version, automatically increasd on updates.

page integer · min: 1 required
per_page integer · min: 1 required
total integer · min: 0 required