Find exception containers

Retrieves a paginated subset of exception containers. By default, the first page is returned with 20 results per page.

Console supports only Elasticsearch APIs. Console doesn’t allow interactions with Kibana APIs. You must use curl or another HTTP tool instead. For more information, refer to Run Elasticsearch API requests.

Request URL

edit

GET <kibana host>:<port>/api/exception_lists/_find

URL query parameters

edit

All parameters are optional:

Name	Type	Description
`page`	Integer	The page number to return.
`per_page`	Integer	The number of containers to return per page.
`sort_field`	String	Determines which field is used to sort the results.
`sort_order`	String	Determines the sort order, which can be `desc` or `asc`.
`cursor`	String	Returns the containers that come after the last container returned in the previous call (use the `cursor` value returned in the previous call). This parameter uses the `tie_breaker_id` field to ensure all containers are sorted and returned correctly. See Search After for more information.
`namespace_type`	String	Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces (`agnostic` or `single`).
`filter`	String	Filters the returned results according to the value of the specified field, using the `<field name>:<field value>` syntax, where `<field name>` can be: `name` `type` `created_by` `updated_by`

Example request

edit

Returns containers, sorted by name in descending order:

GET api/exception_lists/_find?page=1&per_page=2&sort_field=name&sort_order=desc

Response code

edit

200: Indicates a successful call.

Response payload

edit

{
  "data": [
    {
      "_tags": [],
      "created_at": "2020-07-14T10:47:03.421Z",
      "created_by": "LiverpoolFC",
      "description": "Trusted external IPs",
      "id": "5a7f77b0-c5bf-11ea-a3d8-a5b753aeeb9e",
      "list_id": "allowed-IPs",
      "name": "Trusted ext IPs",
      "namespace_type": "single",
      "tags": [
        "network",
        "IP"
      ],
      "tie_breaker_id": "5b39e2f4-bcfa-4199-bcf0-b859c4b805f4",
      "type": "detection",
      "updated_at": "2020-07-14T10:47:03.595Z",
      "updated_by": "LiverpoolFC"
    },
    {
      "_tags": [],
      "created_at": "2020-07-14T08:24:22.884Z",
      "created_by": "LiverpoolFC",
      "description": "Excludes trusted processes",
      "id": "6c03f6a0-c5ab-11ea-a3d8-a5b753aeeb9e",
      "list_id": "allowed-processes",
      "name": "Process exceptions",
      "namespace_type": "single",
      "tags": [
        "hosts",
        "processes"
      ],
      "tie_breaker_id": "65e16c8a-0d45-4e38-8a8f-094658a5df90",
      "type": "detection",
      "updated_at": "2020-07-14T08:24:23.050Z",
      "updated_by": "LiverpoolFC"
    }
  ],
  "page": 1,
  "per_page": 2,
  "total": 6
}

« Create exception item Find exception items »