Import an exception list

View as Markdown
POST /api/exception_lists/_import
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/exception_lists/_import

Refer to Spaces for more information.

Import an exception list and its associated items from an NDJSON file.

Query parameters

  • overwrite boolean

    Determines whether existing exception lists with the same list_id are overwritten. If any exception items have the same item_id, those are also overwritten.

    Default value is false.

  • overwrite_exceptions boolean

    Default value is false.

  • overwrite_action_connectors boolean

    Default value is false.

  • as_new_list boolean

    Determines whether the list being imported will have a new list_id generated. Additional item_id's are generated for each exception item. Both the exception list and its items are overwritten.

    Default value is false.

multipart/form-data

Body Required

  • file string(binary)

    A .ndjson file containing the exception list

Responses

  • 200 application/json

    Successful response

    Hide response attributes Show response attributes object
    • errors array[object] Required
      Hide errors attributes Show errors attributes object
      • error object Required
        Hide error attributes Show error attributes object
        • message string Required
        • status_code integer Required
      • id string(nonempty)

        A string that does not contain only whitespace characters

        Minimum length is 1.

      • item_id string(nonempty)

        A string that does not contain only whitespace characters

        Minimum length is 1.

      • list_id string(nonempty)

        A string that does not contain only whitespace characters

        Minimum length is 1.

    • success boolean Required
    • success_count integer Required

      Minimum value is 0.

    • success_count_exception_list_items integer Required

      Minimum value is 0.

    • success_count_exception_lists integer Required

      Minimum value is 0.

    • success_exception_list_items boolean Required
    • success_exception_lists boolean Required
  • 400 application/json

    Invalid input data response

    One of:
    Security_Exceptions_API_PlatformErrorResponse object Security_Exceptions_API_SiemErrorResponse object
  • 401 application/json

    Unsuccessful authentication response

    Hide response attributes Show response attributes object
    • error string Required
    • message string Required
    • statusCode integer Required
  • 403 application/json

    Not enough privileges response

    Hide response attributes Show response attributes object
    • error string Required
    • message string Required
    • statusCode integer Required
  • 500 application/json

    Internal server error response

    Hide response attributes Show response attributes object
    • message string Required
    • status_code integer Required
POST /api/exception_lists/_import 
curl \
 --request POST 'https://localhost:5601/api/exception_lists/_import' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: multipart/form-data" \
 --form "file=@file"