« Import exception list Update exception container »
Elastic Docs ›Elastic Security Solution [8.16] ›Elastic Security APIs ›Exceptions API

Export exception list

edit

Export exception list

edit

New API Reference

For the most up-to-date API details, refer to exceptions APIs.

Exports an exception list and its associated items to an .ndjson file.

Request URL

edit

POST <kibana host>:<port>/api/exception_lists/_export

URL query parameters

edit
Name Type Description Required

id

String

ID of the exception list.

Yes.

list_id

String

List ID of the exception list.

Yes.

namespace_type

String

Determines whether the exported exception list is associated with a single Kibana space or available in all spaces, using one of the following:

  • single: Associated with the Kibana space in which it is created.
  • agnostic: Available in all Kibana spaces.

No, defaults to single.

include_expired_exceptions

Boolean

Determines whether to include expired exceptions in the exported list.

No, defaults to true.

Example request

edit

Exports the exception list with an id value of b590e8f0-43fa-11eb-ad0b-97969c856022 and a list_id value of 4fcd2765-0ba8-4048-8a65-27afcab72b12, associated with a single Kibana space.

POST api/exception_lists/_export?id=b590e8f0-43fa-11eb-ad0b-97969c856022&list_id=4fcd2765-0ba8-4048-8a65-27afcab72b12&namespace_type=single

Response code

edit
200
Indicates a successful call.

Sample .ndjson file

edit
{"_version":"WzgxLDFd","created_at":"2020-12-22T02:09:23.199Z","created_by":"elastic","description":"test","id":"b590e8f0-43fa-11eb-ad0b-97969c856022","immutable":false,"list_id":"4fcd2765-0ba8-4048-8a65-27afcab72b12","name":"Test Exception List","namespace_type":"single","os_types":[],"tags":[],"tie_breaker_id":"0437982d-4f48-4bcd-ab78-3a9b0696bae9","type":"detection","updated_at":"2020-12-22T02:09:23.257Z","updated_by":"elastic","version":1}
{"_version":"Wzg5LDFd","comments":[],"created_at":"2020-12-22T02:09:48.419Z","created_by":"elastic","description":"test - exception list item","entries":[{"field":"host.name","type":"match","operator":"included","value":"siem-kibana"}],"id":"c4992d30-43fa-11eb-ad0b-97969c856022","item_id":"0f9edfd7-a5b0-4974-b5de-f949b7b89465","list_id":"4fcd2765-0ba8-4048-8a65-27afcab72b12","name":"Test - exception list item","namespace_type":"single","os_types":[],"tags":[],"tie_breaker_id":"56564ed3-c85d-4399-b6ea-cd12617530bd","type":"simple","updated_at":"2020-12-22T02:09:48.486Z","updated_by":"elastic"}
{"exception_list_items_details":{"exported_count":1}}
« Import exception list Update exception container »