Create exception containeredit

Creates an exception container.

The Kibana Console supports only Elasticsearch APIs. You cannot interact with the Kibana APIs with the Console and must use curl or another HTTP tool instead. For more information, refer to Console.

An exception container groups exception items and can be associated with rules. When an exception item’s query evaluates to true, rules do not issue alerts even when the rule’s other criteria are met.

You can assign detection rules with multiple exception containers. For more information, see Create rule and Update rule.

All exception items added to the same container are evaluated using OR logic. That is, if any of the items in a container evaluate to true, the exception prevents the rule from generating an alert. Likewise, OR logic is used for evaluating exceptions when more than one exception container is assigned to a rule. To use the AND operator, you can define multiple clauses (entries) in a single exception item.

Request URLedit

POST <kibana host>:<port>/api/exception_lists

Request bodyedit

A JSON object with these fields:

Name Type Description Required

description

String

Describes the exception container.

Yes

list_id

String

Unique identifier.

No, automatically created when it is not provided.

meta

Object

Placeholder for metadata about the list container.

No

name

String

The exception container’s name.

Yes

namespace_type

String

Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:

  • single: Only available in the Kibana space in which it is created.
  • agnostic: Available in all Kibana spaces.

No, defaults to single.

tags

String[]

String array containing words and phrases to help categorize exception containers.

No

type

String

The type of exception, which must be one of these:

  • detection: Detection rule exception
  • endpoint: Endpoint alert exception

Yes

Example requestsedit

Creates an exception container for holding trusted Linux process exception items:

POST api/exception_lists
{
  "description": "Excludes Linux trusted processes",
  "name": "Linux process exceptions",
  "list_id": "trusted-linux-processes",
  "type": "detection",
  "namespace_type": "single",
  "tags": [
    "linux",
    "processes"
  ]
}

Response codeedit

200
Indicates a successful call.

Response payloadedit

The exception container object with a unique ID.

{
  "_tags": [],
  "created_at": "2020-07-13T09:33:46.187Z",
  "created_by": "LiverpoolFC",
  "description": "Excludes Linux trusted processes",
  "id": "f320c070-c4eb-11ea-80bb-11861bae2798", 
  "list_id": "trusted-linux-processes", 
  "name": "Linux process exceptions",
  "namespace_type": "single", 
  "tags": [
    "linux",
    "processes"
  ],
  "tie_breaker_id": "2c08d5a5-2ecc-4d5a-acfb-0a367f25b3f3",
  "type": "detection", 
  "updated_at": "2020-07-13T09:33:46.359Z",
  "updated_by": "LiverpoolFC"
}

These values are required to associate the exception container with detection rules:

id

list_id

namespace_type

type