stack kb security-exceptions-api update-exception-list cli command

Auth required Idempotent Scope: global

elastic stack kb security-exceptions-api update-exception-list \
  --description <description> \
  --name <name> \
  --type <type> \
  [options]

Update an exception list

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

Options

--description string required
--name string required
--type enum required: Values: detection, rule_default, endpoint, endpoint_trusted_apps, endpoint_trusted_devices, endpoint_events, endpoint_host_isolation_exceptions, endpoint_blocklists, endpoint_custom_yara_signatures
--version string: The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.
--id string
--list-id string
--meta string
--namespace-type enum: Values: agnostic, single
--os-types string[]: Repeatable: pass --os-types multiple times to supply more than one value
--tags string[]: Repeatable: pass --tags multiple times to supply more than one value
--x-version number
--input-file string: path to a JSON file to use as command input
--dry-run: validate all inputs and exit without performing any action (preview changes without applying them)
--no-validate: skip input validation and send the request as-is

--output-fields string: comma-separated list of fields to include in output (dot-notation supported)
--output-template string: Mustache-like template for custom text output (e.g. "{{id}}: {{name}}")
--json: output as JSON