Update exception item
editUpdate exception item
editUpdates an existing exception item.
Request URL
editPUT <kibana host>:<port>/api/exception_lists/items
Request body
editName | Type | Description | Required |
---|---|---|---|
|
comments[] |
Array of comments to be appended:
Comments cannot be modified—they can only be appended. |
No, defaults to empty array. |
|
String |
Describes the exception item. |
Yes |
|
Array containing the
exception queries. Boolean |
Yes |
|
|
String |
The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. |
No |
|
String |
The item’s unique identifier. |
Yes, when the item’s |
|
String |
The |
Yes, when
the item’s |
|
Object |
Placeholder for metadata about the exception item. |
No |
|
String |
The exception item’s name. |
Yes |
|
String |
Determines whether the exception item is available in all Kibana spaces or just the space in which it is created, where:
|
No, defaults to |
|
String[] |
String array containing words and phrases to help categorize exception items. |
No |
|
String |
Exception query type, must be |
Yes |
Example request
editUpdates the entries
object:
PUT api/exception_lists/items { "description": "Process allowlist", "entries": [ { "field": "process.name", "operator": "included", "type": "match", "value": "maintenance" }, { "field": "host.name", "operator": "included", "type": "match_any", "value": [ "liv-win-anf", "livw-win-mel", "linux-anfield", "new-host" ] } ], "item_id": "allow-process-on-machines", "name": "Host-process exclusions", "namespace_type": "single", "tags": [ "hosts", "processes" ], "type": "simple" }
Response code
edit-
200
- Indicates a successful call.
Response payload
editThe updated object, including the time it was updated.
Example response:
{ "_tags": [], "comments": [], "created_at": "2020-07-15T06:28:32.457Z", "created_by": "elastic", "description": "Process allowlist", "entries": [ { "field": "process.name", "operator": "included", "type": "match", "value": "maintenance" }, { "field": "host.name", "operator": "included", "type": "match_any", "value": [ "liv-win-anf", "livw-win-mel", "linux-anfield", "new-host" ] } ], "id": "67a70610-c664-11ea-bab5-9d6ae015701b", "item_id": "allow-process-on-machines", "list_id": "allowed-processes", "name": "Host-process exclusions", "namespace_type": "single", "tags": [ "hosts", "processes" ], "tie_breaker_id": "15d7f2eb-7192-4f4b-a803-ad8a4f5efd08", "type": "simple", "updated_at": "2020-07-15T06:28:50.494Z", "updated_by": "elastic" }