Module exceptions 

Detection exception lists and items. Single lists are scoped to a Kibana space; Agnostic lists are shared across spaces. Referenced value-list contents are managed separately and are not included in exception exports.

Create lists and items from NewList and NewItem. Change existing ones through ExceptionList::edit and ExceptionItem::edit, which start from the retrieved state, so fields that are not changed are sent back as they were. Retrieved resources also carry their namespace: pass them to get_*, delete_* and find_items instead of repeating a selector and namespace.

Structs

Comment

A new comment. Kibana records its author and time.

CreateItem

POST /api/exception_lists/items

CreateList

POST /api/exception_lists

DeleteItem

DELETE /api/exception_lists/items

DeleteList

DELETE /api/exception_lists

DuplicateList

POST /api/exception_lists/_duplicate

ExceptionItem

A retrieved exception item and its current entries and comments. Use Self::edit to change it without dropping unchanged writable fields.

ExceptionList

A retrieved exception list. Use Self::edit to retain its writable fields on update.

ExceptionPage

Exceptions

ExportList

POST /api/exception_lists/_export

FindItems

GET /api/exception_lists/items/_find

FindLists

GET /api/exception_lists/_find

GetItem

GET /api/exception_lists/items

GetList

GET /api/exception_lists

ImportLists

POST /api/exception_lists/_import

ImportResult

HTTP 200 can contain failed list or item imports; inspect success and errors.

ItemComment

A comment stored on an item.

ItemEdit

Changes to an existing item for Exceptions::update_item, created by ExceptionItem::edit.

ItemTarget

An item to read or delete. See ListTarget for how the namespace is chosen.

ItemsOf

The list whose items Exceptions::find_items searches: a list_id, or a retrieved ExceptionList, which also selects its namespace.

ListEdit

Changes to an existing list for Exceptions::update_list, created by ExceptionList::edit.

ListReference

Identifies a list for rule associations and exports.

ListTarget

A list to read, delete or summarize.

NewItem

An item definition for Exceptions::create_item. To change an existing item, use ExceptionItem::edit.

NewList

A list definition for Exceptions::create_list. To change an existing list, use ExceptionList::edit.

Summary

GET /api/exception_lists/summary

UpdateItem

PUT /api/exception_lists/items

UpdateList

PUT /api/exception_lists

ValueListReference

A value list referenced by Entry::List.

Enums

Entry

One condition in an exception item. The item’s entries are combined with AND.

ItemSelector

ListSelector

NamespaceType

Whether an exception list or item belongs to one space or is shared across spaces.

NestedEntry

Conditions inside Entry::Nested. Nesting is one level deep.

Operator

OsType