Import an exception list

POST /api/exception_lists/_import

Import an exception list and its associated items from an NDJSON file.

Query parameters

overwrite boolean

Determines whether existing exception lists with the same list_id are overwritten. If any exception items have the same item_id, those are also overwritten.

Default value is false.
overwrite_exceptions boolean

Default value is false.
overwrite_action_connectors boolean

Default value is false.
as_new_list boolean

Determines whether the list being imported will have a new list_id generated. Additional item_id's are generated for each exception item. Both the exception list and its items are overwritten.

Default value is false.

multipart/form-data; Elastic-Api-Version=2023-10-31

Body Required

file string(binary)

A .ndjson file containing the exception list

Responses

200 application/json; Elastic-Api-Version=2023-10-31

Successful response
Hide response attributes Show response attributes object
- errors array[object] Required
  
  Hide errors attributes Show errors attributes object
  
  error object Required
  
  Additional properties are allowed.
  
  Hide error attributes Show error attributes object
  
  message string Required
  
  status_code integer Required
  
  id string
  
  A string that is not empty and does not contain only whitespace
  
  Minimum length is 1. Format should match the following pattern: ^(?! *$).+$.
  
  item_id string
  
  A string that is not empty and does not contain only whitespace
  
  Minimum length is 1. Format should match the following pattern: ^(?! *$).+$.
  
  list_id string
  
  A string that is not empty and does not contain only whitespace
  
  Minimum length is 1. Format should match the following pattern: ^(?! *$).+$.
- success boolean Required
- success_count integer Required
  
  Minimum value is 0.
- success_count_exception_list_items integer Required
  
  Minimum value is 0.
- success_count_exception_lists integer Required
  
  Minimum value is 0.
- success_exception_list_items boolean Required
- success_exception_lists boolean Required
400 application/json; Elastic-Api-Version=2023-10-31

Invalid input data response
One of:
Security_Exceptions_API_PlatformErrorResponse object Security_Exceptions_API_SiemErrorResponse object
Hide attributes Show attributes

error string Required

message string Required

statusCode integer Required
Hide attributes Show attributes

message string Required

status_code integer Required
401 application/json; Elastic-Api-Version=2023-10-31

Unsuccessful authentication response
Hide response attributes Show response attributes object
- error string Required
- message string Required
- statusCode integer Required
403 application/json; Elastic-Api-Version=2023-10-31

Not enough privileges response
Hide response attributes Show response attributes object
- error string Required
- message string Required
- statusCode integer Required
500 application/json; Elastic-Api-Version=2023-10-31

Internal server error response
Hide response attributes Show response attributes object
- message string Required
- status_code integer Required

POST /api/exception_lists/_import

curl \
 -X POST https://localhost:5601/api/exception_lists/_import \
 -H "Content-Type: multipart/form-data; Elastic-Api-Version=2023-10-31"

Response examples (200)

{
  "errors": [
    {
      "error": {
        "message": "string",
        "status_code": 42
      },
      "id": "string",
      "item_id": "string",
      "list_id": "string"
    }
  ],
  "success": true,
  "success_count": 42,
  "success_count_exception_list_items": 42,
  "success_count_exception_lists": 42,
  "success_exception_list_items": true,
  "success_exception_lists": true
}

Response examples (400)

{
  "error": "string",
  "message": "string",
  "statusCode": 42
}

{
  "message": "string",
  "status_code": 42
}

Response examples (401)

{
  "error": "string",
  "message": "string",
  "statusCode": 42
}

Response examples (403)

{
  "error": "string",
  "message": "string",
  "statusCode": 42
}

Response examples (500)

{
  "message": "string",
  "status_code": 42
}