IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Exceptions API Create exception item »

› › ›

Create exception container

edit

Create exception container

edit

Creates an exception container.

An exception container groups exception items and can be associated with rules. When an exception item’s query evaluates to true, rules do not issue alerts even when the rule’s other criteria are met.

You can assign detection rules with multiple exception containers. For more information, see Create rule and Update rule.

All exception items added to the same container are evaluated using OR logic. That is, if any of the items in a container evaluate to true, the exception prevents the rule from generating an alert. Likewise, OR logic is used for evaluating exceptions when more than one exception container is assigned to a rule. To use the AND operator, you can define multiple clauses (entries) in a single exception item.

Request URL

edit

POST <kibana host>:<port>/api/exception_lists

Request body

edit

A JSON object with these fields:

Name	Type	Description	Required
`description`	String	Describes the exception container.	Yes
`list_id`	String	Unique identifier.	No, automatically created when it is not provided.
`meta`	Object	Placeholder for metadata about the list container.	No
`name`	String	The exception container’s name.	Yes
`namespace_type`	String	Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where: `single`: Only available in the Kibana space in which it is created. `agnostic`: Available in all Kibana spaces.	No, defaults to `single`.
`tags`	String[]	String array containing words and phrases to help categorize exception containers.	No
`type`	String	The type of exception, which must be one of these: `detection`: Detection rule exception `endpoint`: Endpoint alert exception	Yes

Example requests

edit

Creates an exception container for holding trusted Linux process exception items:

POST api/exception_lists
{
  "description": "Excludes Linux trusted processes",
  "name": "Linux process exceptions",
  "list_id": "trusted-linux-processes",
  "type": "detection",
  "namespace_type": "single",
  "tags": [
    "linux",
    "processes"
  ]
}

Response code

edit

200: Indicates a successful call.

Response payload

edit

The exception container object with a unique ID.

{
  "_tags": [],
  "created_at": "2020-07-13T09:33:46.187Z",
  "created_by": "LiverpoolFC",
  "description": "Excludes Linux trusted processes",
  "id": "f320c070-c4eb-11ea-80bb-11861bae2798", 
  "list_id": "trusted-linux-processes", 
  "name": "Linux process exceptions",
  "namespace_type": "single", 
  "tags": [
    "linux",
    "processes"
  ],
  "tie_breaker_id": "2c08d5a5-2ecc-4d5a-acfb-0a367f25b3f3",
  "type": "detection", 
  "updated_at": "2020-07-13T09:33:46.359Z",
  "updated_by": "LiverpoolFC"
}

These values are required to associate the exception container with detection rules:

	`id`
	`list_id`
	`namespace_type`
	`type`

« Exceptions API Create exception item »