Lists index endpoint

Before using exceptions and lists, use the index endpoint to create .lists and .items system data streams in the relevant Kibana space.

For information about the permissions and privileges required to create .lists and .items data streams, refer to Enable and access detections.

Creates .lists and .items data streams. The data streams naming convention is .lists-<space name> and .items-<space name>.

POST <kibana host>:<port>/api/lists/index

Creates .lists and .items data streams.

POST api/lists/index

Verifies .lists and .items data streams exist.

GET <kibana host>:<port>/api/lists/index

Verifies the lists data stream for the Kibana security exists:

GET api/lists/index

Example response when the data streams exist:

{
  "list_index": true,
  "list_item_index": true
}

Example response when the data streams do not exist:

{
  "message": "data stream .lists-default and data stream .items-default does not exist",
  "status_code": 404
}

Deletes the .lists and .items data streams.

DELETE <kibana host>:<port>/api/lists/index

Deletes the .lists and .items data streams:

DELETE api/lists/index