Update list container

edit

Updates an existing list container.

Console supports only Elasticsearch APIs. Console doesn’t allow interactions with Kibana APIs. You must use curl or another HTTP tool instead. For more information, refer to Run Elasticsearch API requests.

You can use PUT or PATCH methods to update list containers, where:

  • PUT replaces the original container and deletes fields that are not specified.
  • PATCH updates the specified fields.

Request URL

edit

PUT <kibana host>:<port>/api/lists

PATCH <kibana host>:<port>/api/lists

Request body

edit

A JSON object with:

  • The id of the list container you want to update.
  • The fields you want to modify.

If you call PUT to update a rule, all unspecified fields are deleted. You cannot modify the id and type fields.

For PATCH calls, any of the fields can be modified, whereas for PUT calls, some fields are required.

Name Type Description Required (PUT calls)

description

String

Describes the list container.

Yes

meta

Object

Placeholder for metadata about the list container.

No

name

String

The list container’s name.

Yes

_version

String

Base-64 encoded value of if_seq_no and if_primary_term parameters, used to prevent update conflicts (see Optimistic concurrency control).

No

Example request

edit

Updates the name field:

PATCH api/lists
{
  "id": "internal-ip-excludes",
  "name": "Trusted internal IP addresses",
  "_version": "WzYsMV0="
}

Response code

edit
200
Indicates a successful call.

Response payload

edit

The updated object, including the time it was updated.

Example response:

{
  "_version": "WzcsMV0=",
  "created_at": "2020-08-11T10:38:51.087Z",
  "created_by": "elastic",
  "description": "Contains list items that exclude internal IP addresses from detection rule matches.",
  "id": "internal-ip-excludes-meta",
  "immutable": false,
  "name": "Trusted internal IP addresses",
  "tie_breaker_id": "195f54fb-244d-4f9a-9a5b-e728901347e0",
  "type": "ip",
  "updated_at": "2020-08-11T10:42:30.205Z",
  "updated_by": "elastic",
  "version": 2
}