New

The executive guide to generative AI

Read more
About usPartnersSupport|Login
IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Import exception list Update exception container »
Elastic Docs ›Elastic Security Solution [8.10] ›Elastic Security APIs ›Exceptions API

Export exception list

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Export exception list

edit

Exports an exception list and its associated items to an .ndjson file.

Request URL

edit

POST <kibana host>:<port>/api/exception_lists/_export

URL query parameters

edit
Name Type Description Required

id

String

ID of the exception list.

Yes.

list_id

String

List ID of the exception list.

Yes.

namespace_type

String

Determines whether the exported exception list is associated with a single Kibana space or available in all spaces, using one of the following:

  • single: Associated with the Kibana space in which it is created.
  • agnostic: Available in all Kibana spaces.

No, defaults to single.

include_expired_exceptions

Boolean

Determines whether to include expired exceptions in the exported list.

No, defaults to true.

Example request

edit

Exports the exception list with an id value of b590e8f0-43fa-11eb-ad0b-97969c856022 and a list_id value of 4fcd2765-0ba8-4048-8a65-27afcab72b12, associated with a single Kibana space.

POST api/exception_lists/_export?id=b590e8f0-43fa-11eb-ad0b-97969c856022&list_id=4fcd2765-0ba8-4048-8a65-27afcab72b12&namespace_type=single
Copy as curlTry in Elastic 

Response code

edit
200
Indicates a successful call.

Sample .ndjson file

edit
{"_version":"WzgxLDFd","created_at":"2020-12-22T02:09:23.199Z","created_by":"elastic","description":"test","id":"b590e8f0-43fa-11eb-ad0b-97969c856022","immutable":false,"list_id":"4fcd2765-0ba8-4048-8a65-27afcab72b12","name":"Test Exception List","namespace_type":"single","os_types":[],"tags":[],"tie_breaker_id":"0437982d-4f48-4bcd-ab78-3a9b0696bae9","type":"detection","updated_at":"2020-12-22T02:09:23.257Z","updated_by":"elastic","version":1}
{"_version":"Wzg5LDFd","comments":[],"created_at":"2020-12-22T02:09:48.419Z","created_by":"elastic","description":"test - exception list item","entries":[{"field":"host.name","type":"match","operator":"included","value":"siem-kibana"}],"id":"c4992d30-43fa-11eb-ad0b-97969c856022","item_id":"0f9edfd7-a5b0-4974-b5de-f949b7b89465","list_id":"4fcd2765-0ba8-4048-8a65-27afcab72b12","name":"Test - exception list item","namespace_type":"single","os_types":[],"tags":[],"tie_breaker_id":"56564ed3-c85d-4399-b6ea-cd12617530bd","type":"simple","updated_at":"2020-12-22T02:09:48.486Z","updated_by":"elastic"}
{"exception_list_items_details":{"exported_count":1}}
« Import exception list Update exception container »

On this page

Was this helpful?
Feedback