The SIEM app is now a part of the Elastic Security solution.
Click
here to view SIEM documentation for previous releases.
Update list containeredit
Updates an existing list container.
You can use PUT
or PATCH
methods to update list containers, where:
-
PUT
replaces the original container and deletes fields that are not specified. -
PATCH
updates the specified fields.
Request bodyedit
A JSON object with:
-
The
id
of the list container you want to update. - The fields you want to modify.
If you call PUT
to update a rule, all unspecified fields are
deleted. You cannot modify the id
and type
fields.
For PATCH
calls, any of the fields can be modified, whereas for PUT
calls,
some fields are required.
Name | Type | Description | Required (PUT calls) |
---|---|---|---|
|
String |
Describes the list container. |
Yes |
|
Object |
Placeholder for metadata about the list container. |
No |
|
String |
The list container’s name. |
Yes |
|
String |
Base-64 encoded value of |
No |
Example requestedit
Updates the name
field:
PATCH api/lists { "id": "internal-ip-excludes", "name": "Trusted internal IP addresses", "_version": "WzYsMV0=" }
Response codeedit
-
200
- Indicates a successful call.
Response payloadedit
The updated object, including the time it was updated.
Example response:
{ "_version": "WzcsMV0=", "created_at": "2020-08-11T10:38:51.087Z", "created_by": "elastic", "description": "Contains list items that exclude internal IP addresses from detection rule matches.", "id": "internal-ip-excludes-meta", "immutable": false, "name": "Trusted internal IP addresses", "tie_breaker_id": "195f54fb-244d-4f9a-9a5b-e728901347e0", "type": "ip", "updated_at": "2020-08-11T10:42:30.205Z", "updated_by": "elastic", "version": 2 }