Need help with your APIs? I offer API discovery, governance & evangelism services. Explore services →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Kibana Security Endpoint Exceptions API API

Endpoint Exceptions API allows you to manage detection rule endpoint exceptions to prevent a rule from generating an alert from incoming events even when the rule's other criteria are met.

Kibana Security Endpoint Exceptions API API is one of 60 APIs that Kibana publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Security Endpoint Exceptions API. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and authentication docs.

This API exposes 6 operations across 3 paths, and defines 40 schemas. It is described by OpenAPI 3.0.3.

Requests are made against a single base URL, https://{kibana_url}.

6 operations 3 paths 40 schemas 1 DELETE2 GET2 POST1 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.0.3
Base URL
https://localhost:5601/api
Authentication
API Key, HTTP Basic
Contact
Kibana Team
Resource Areas
1

Authentication & Security 2

Kibana Security Endpoint Exceptions API API declares 2 security schemes for authenticating requests. An API key is passed in the header as Authorization (apiKeyAuth). It accepts HTTP basic authentication (basicAuth). By default, every request must be authenticated.

  • apiKeyAuth — These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64A…

Paths & Operations 6

Across 3 paths, the API surfaces 6 operations — 1 DELETE, 2 GET, 2 POST, 1 PUT. Each is listed below with its method, path, parameters, and response codes.

Security Endpoint Exceptions API 6

Endpoint Exceptions API allows you to manage detection rule endpoint exceptions to prevent a rule from generating an alert from incoming events even when the rule's other criteria…

POST
/api/endpoint_list
Create an Elastic Endpoint rule exception list
CreateEndpointList → 200400401403500
DELETE
/api/endpoint_list/items
Delete an Elastic Endpoint exception list item
DeleteEndpointListItem 2 params → 200400401403404500
GET
/api/endpoint_list/items
Get an Elastic Endpoint rule exception list item
ReadEndpointListItem 2 params → 200400401403404500
POST
/api/endpoint_list/items
Create an Elastic Endpoint rule exception list item
CreateEndpointListItem body → 200400401403409500
PUT
/api/endpoint_list/items
Update an Elastic Endpoint rule exception list item
UpdateEndpointListItem body → 200400401403404500
GET
/api/endpoint_list/items/_find
Get Elastic Endpoint exception list items
FindEndpointListItems 5 params → 200400401403404500

Schemas 40

The contract defines 40 schemas that model the data the API accepts and returns. The most detailed are Security_Endpoint_Exceptions_API_ExceptionListItem (19 properties), Security_Endpoint_Exceptions_API_ExceptionList (17 properties), Security_Endpoint_Exceptions_API_ExceptionListItemComment (6 properties), Security_Endpoint_Exceptions_API_ExceptionListItemEntryList (4 properties). Each schema is shown below with its type and property counts.

Security_Endpoint_Exceptions_API_EndpointList
Security_Endpoint_Exceptions_API_ExceptionListOsTypeArray
array
Use this field to specify the operating system. Only enter one value.
Security_Endpoint_Exceptions_API_ExceptionListName
string
The name of the exception list.
Security_Endpoint_Exceptions_API_ExceptionListItemComment
object
6 properties 4 required
Security_Endpoint_Exceptions_API_ExceptionListItemTags
array
Security_Endpoint_Exceptions_API_ExceptionListItem
object
19 properties 14 required
Security_Endpoint_Exceptions_API_SiemErrorResponse
object
2 properties 2 required
Security_Endpoint_Exceptions_API_ExceptionListVersion
integer
The document version, automatically increasd on updates.
Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchWildcard
object
4 properties 4 required
Security_Endpoint_Exceptions_API_ExceptionListItemHumanId
string
Human readable string identifier, e.g. trusted-linux-processes
Security_Endpoint_Exceptions_API_ExceptionNamespaceType
string
Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where: - single: Only available in the K…
Security_Endpoint_Exceptions_API_ExceptionListItemEntryExists
object
3 properties 3 required
Security_Endpoint_Exceptions_API_ListType
string
Specifies the Elasticsearch data type of excludes the list container holds. Some common examples: - keyword: Many ECS fields are Elasticsearch keywords - ip: I…
Security_Endpoint_Exceptions_API_ExceptionListItemId
string
Exception's identifier.
Security_Endpoint_Exceptions_API_ExceptionListItemName
string
Exception list name.
Security_Endpoint_Exceptions_API_ExceptionListItemExpireTime
string
The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
Security_Endpoint_Exceptions_API_ExceptionListItemCommentArray
array
Array of comment fields: - comment (string): Comments about the exception item.
Security_Endpoint_Exceptions_API_ExceptionListTags
array
String array containing words and phrases to help categorize exception containers.
Security_Endpoint_Exceptions_API_ExceptionListItemEntryList
object
4 properties 4 required
Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchAny
object
4 properties 4 required
Security_Endpoint_Exceptions_API_NonEmptyString
string
A string that does not contain only whitespace characters
Security_Endpoint_Exceptions_API_ExceptionListType
string
The type of exception list to be created. Different list types may denote where they can be utilized.
Security_Endpoint_Exceptions_API_ExceptionListHumanId
string
The exception list's human-readable string identifier. For endpoint artifacts, use one of the following values: endpointlist: [Elastic Endpoint exception list]…
Security_Endpoint_Exceptions_API_ExceptionListItemDescription
string
Describes the exception list.
Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator
string
Security_Endpoint_Exceptions_API_ExceptionListId
string
Exception list's identifier.
Security_Endpoint_Exceptions_API_ExceptionListItemOsTypeArray
array
Security_Endpoint_Exceptions_API_ExceptionListMeta
object
Placeholder for metadata about the list container.
Security_Endpoint_Exceptions_API_ListId
string
Value list's identifier.
Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatch
object
4 properties 4 required
Security_Endpoint_Exceptions_API_PlatformErrorResponse
object
3 properties 3 required
Security_Endpoint_Exceptions_API_ExceptionListDescription
string
Describes the exception list.
Security_Endpoint_Exceptions_API_ExceptionListItemMeta
object
Security_Endpoint_Exceptions_API_ExceptionListItemType
string
Security_Endpoint_Exceptions_API_ExceptionList
object
17 properties 13 required
Security_Endpoint_Exceptions_API_ExceptionListItemEntryNestedEntryItem
Security_Endpoint_Exceptions_API_ExceptionListItemEntry
Security_Endpoint_Exceptions_API_ExceptionListItemEntryArray
array
Security_Endpoint_Exceptions_API_ExceptionListOsType
string
Use this field to specify the operating system.
Security_Endpoint_Exceptions_API_ExceptionListItemEntryNested
object
3 properties 3 required

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

kibana-security-endpoint-exceptions-api-api-openapi.yml Raw ↑

Other APIs Kibana publishes across the network.

Kibana Actions API
Kibana agent builder API
Kibana alerting API
Kibana APM agent configuration API
Kibana APM agent keys API
Kibana APM annotations API
Kibana APM server schema API
Kibana APM sourcemaps API
Kibana cases API
Kibana connectors API
Kibana Data streams API
Kibana data views API