Export exception listedit
Exports an exception list and its associated items to an .ndjson file.
Request URLedit
POST <kibana host>:<port>/api/exception_lists/_export
URL query parametersedit
| Name | Type | Description | Required |
|---|---|---|---|
|
String |
ID of the exception list. |
Yes. |
|
String |
List ID of the exception list. |
Yes. |
|
String |
Determines whether the exported exception list is associated with a single Kibana space or available in all spaces, using one of the following:
|
No, defaults to |
|
Boolean |
Determines whether to include expired exceptions in the exported list. |
No, defaults to |
Example requestedit
Exports the exception list with an id value of b590e8f0-43fa-11eb-ad0b-97969c856022 and a list_id value of 4fcd2765-0ba8-4048-8a65-27afcab72b12, associated with a single Kibana space.
POST api/exception_lists/_export?id=b590e8f0-43fa-11eb-ad0b-97969c856022&list_id=4fcd2765-0ba8-4048-8a65-27afcab72b12&namespace_type=single
Response codeedit
-
200 - Indicates a successful call.
Sample .ndjson fileedit
{"_version":"WzgxLDFd","created_at":"2020-12-22T02:09:23.199Z","created_by":"elastic","description":"test","id":"b590e8f0-43fa-11eb-ad0b-97969c856022","immutable":false,"list_id":"4fcd2765-0ba8-4048-8a65-27afcab72b12","name":"Test Exception List","namespace_type":"single","os_types":[],"tags":[],"tie_breaker_id":"0437982d-4f48-4bcd-ab78-3a9b0696bae9","type":"detection","updated_at":"2020-12-22T02:09:23.257Z","updated_by":"elastic","version":1}
{"_version":"Wzg5LDFd","comments":[],"created_at":"2020-12-22T02:09:48.419Z","created_by":"elastic","description":"test - exception list item","entries":[{"field":"host.name","type":"match","operator":"included","value":"siem-kibana"}],"id":"c4992d30-43fa-11eb-ad0b-97969c856022","item_id":"0f9edfd7-a5b0-4974-b5de-f949b7b89465","list_id":"4fcd2765-0ba8-4048-8a65-27afcab72b12","name":"Test - exception list item","namespace_type":"single","os_types":[],"tags":[],"tie_breaker_id":"56564ed3-c85d-4399-b6ea-cd12617530bd","type":"simple","updated_at":"2020-12-22T02:09:48.486Z","updated_by":"elastic"}
{"exception_list_items_details":{"exported_count":1}}