Kibana Security Lists API API
Lists can be used with detection rule exceptions to define values that prevent a rule from generating alerts.Lists are made up of:* **List containers**: A container for values of the same Elasticsearch data type. The following data types can be used: * `boolean` * `byte` * `date` * `date_nanos` * `date_range` * `double` * `double_range` * `float` * `float_range` * `half_float` * `integer` * `integer_range` * `ip` * `ip_range` * `keyword` * `long` * `long_range` * `short` * `text`* **List items**: The values used to determine whether the exception prevents an alert from being generated.All list items in the same list container must be of the same data type, and each item defines a single value. For example, an IP list container named `internal-ip-addresses-southport` contains five items, where each item defines one internal IP address:1. `192.168.1.1`2. `192.168.1.3`3. `192.168.1.18`4. `192.168.1.12`5. `192.168.1.7`To use these IP addresses as values for defining rule exceptions, use the Security exceptions API to [create an exception list item](../operation/operation-createexceptionlistitem) that references the `internal-ip-addresses-southport` list.> info> Lists cannot be added directly to rules, nor do they define the operators used to determine when exceptions are applied (`is in list`, `is not in list`). Use an exception item to define the operator and associate it with an [exception container](../operation/operation-createexceptionlist). You can then add the exception container to a rule's `exceptions_list` object.## Lists requirementsBefore you can start using lists, you must create the `.lists` and `.items` data streams for the relevant Kibana space. To do this, use the [Create list data streams](../operation/operation-createlistindex) endpoint. Once these data streams are created, your role needs privileges to manage rules. Refer to [Enable and access detections](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui) for a complete list of requirements.
Kibana Security Lists API API is one of 60 APIs that Kibana publishes on the APIs.io network, described by a machine-readable OpenAPI specification.
Tagged areas include Security Lists API. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and authentication docs.
This API exposes 18 operations across 8 paths, and defines 20 schemas. It is described by OpenAPI 3.0.3.
Requests are made against a single base URL, https://{kibana_url}.
Metadata
The identity and technical contract details declared by the specification.
Authentication & Security 2
Kibana Security Lists API API declares
2 security schemes
for authenticating requests.
An API key is passed in the header as Authorization (apiKeyAuth).
It accepts HTTP basic authentication (basicAuth).
By default, every request must be authenticated.
apiKeyAuth— These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64A…
Paths & Operations 18
Across 8 paths, the API surfaces 18 operations — 3 DELETE, 6 GET, 2 PATCH, 5 POST, 2 PUT. Each is listed below with its method, path, parameters, and response codes.
Lists can be used with detection rule exceptions to define values that prevent a rule from generating alerts. Lists are made up of: List containers: A container for values of the…
Schemas 20
The contract defines 20 schemas that model the data the API accepts and returns. The most detailed are Security_Lists_API_List (14 properties), Security_Lists_API_ListItem (12 properties), Security_Lists_API_ListItemPrivileges (5 properties), Security_Lists_API_ListPrivileges (5 properties). Each schema is shown below with its type and property counts.
Specification
The full machine-readable OpenAPI contract behind this narrative.
Source
More from Kibana 12
Other APIs Kibana publishes across the network.