Create exception container

edit

Creates an exception container.

An exception container groups exception items and can be associated with rules. When an exception item’s query evaluates to true, rules do not issue alerts even when the rule’s other criteria are met.

You can assign detection rules with multiple exception containers. For more information, see Create rule and Update rule.

All exception items added to the same container are evaluated using OR logic. That is, if any of the items in a container evaluate to true, the exception prevents the rule from generating an alert. Likewise, OR logic is used for evaluating exceptions when more than one exception container is assigned to a rule. To use the AND operator, you can define multiple clauses (entries) in a single exception item.

Request URL

edit

POST <kibana host>:<port>/api/exception_lists

Request body

edit

A JSON object with these fields:

Name Type Description Required

description

String

Describes the exception container.

Yes

list_id

String

Unique identifier.

No, automatically created when it is not provided.

meta

Object

Placeholder for metadata about the list container.

No

name

String

The exception container’s name.

Yes

namespace_type

String

Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:

  • single: Only available in the Kibana space in which it is created.
  • agnostic: Available in all Kibana spaces.

No, defaults to single.

tags

String[]

String array containing words and phrases to help categorize exception containers.

No

type

String

The type of exception, which must be one of these:

  • detection: Detection rule exception
  • endpoint: Endpoint alert exception

Yes

Example requests

edit

Creates an exception container for holding trusted Linux process exception items:

POST api/exception_lists
{
  "description": "Excludes Linux trusted processes",
  "name": "Linux process exceptions",
  "list_id": "trusted-linux-processes",
  "type": "detection",
  "namespace_type": "single",
  "tags": [
    "linux",
    "processes"
  ]
}

Response code

edit
200
Indicates a successful call.

Response payload

edit

The exception container object with a unique ID.

{
  "_tags": [],
  "created_at": "2020-07-13T09:33:46.187Z",
  "created_by": "LiverpoolFC",
  "description": "Excludes Linux trusted processes",
  "id": "f320c070-c4eb-11ea-80bb-11861bae2798", 
  "list_id": "trusted-linux-processes", 
  "name": "Linux process exceptions",
  "namespace_type": "single", 
  "tags": [
    "linux",
    "processes"
  ],
  "tie_breaker_id": "2c08d5a5-2ecc-4d5a-acfb-0a367f25b3f3",
  "type": "detection", 
  "updated_at": "2020-07-13T09:33:46.359Z",
  "updated_by": "LiverpoolFC"
}

These values are required to associate the exception container with detection rules:

id

list_id

namespace_type

type