Elastic Stack

Elastic Stack (ELK Stack) Security Exceptions API

Exceptions are associated with detection and endpoint rules, and are used to prevent a rule from generating an alert from incoming events, even when the rule's other criteria are met. They can help reduce the number of false positives and prevent trusted processes and network activity from generating unnecessary alerts. Exceptions are made up of: * **Exception containers**: A container for related exceptions. Generally, a single exception container contains all the exception items relevant for a subset of rules. For example, a container can be used to group together network-related exceptions that are relevant for a large number of network rules. The container can then be associated with all the relevant rules. * **Exception items**: The query (fields, values, and logic) used to prevent rules from generating alerts. When an exception item's query evaluates to `true`, the rule does not generate an alert. For detection rules, you can also use lists to define rule exceptions. A list holds multiple values of the same Elasticsearch data type, such as IP addresses. These values are used to determine when an exception prevents an alert from being generated. > info > You cannot use lists with endpoint rule exceptions. > info > Only exception containers can be associated with rules. You cannot directly associate an exception item or a list container with a rule. To use list exceptions, create an exception item that references the relevant list container. ## Exceptions requirements Before you can start working with exceptions that use value lists, you must create the `.lists` and `.items` data streams for the relevant Kibana space. To do this, use the [Create list data streams](../operation/operation-createlistindex) endpoint. Once these data streams are created, your role needs privileges to manage rules. For a complete list of requirements, refer to [Enable and access detections](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui).

Documentation GitHub OpenAPI

Business capability

Threat Detection & Response Management BC-620.30

Operations 16

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /api/detection_engine/rules/{id}/exceptions Add exception items to a detection rule · Create rule exception items #

Ask an LLM

“How do I add an exception directly to one detection rule so it stops alerting on known-good activity?”

“Can I attach several exception items to a rule in one request?”

Tell an agent

Add exception items {items} to detection rule {id}.

Create rule exceptions {items} on rule {id} to suppress false positives.

DELETE /api/exception_lists Delete an exception list · Delete an exception list #

Ask an LLM

“How do I permanently delete an exception list?”

“Does deleting an exception list remove it from the rules that use it?”

Tell an agent destructive · confirm first

Delete exception list {list_id}.

Delete the exception list with id {id} in namespace {namespace_type}.

GET /api/exception_lists Get an exception list's details · Get exception list details #

Ask an LLM

“What are the details of a specific exception list?”

“Can I look up an exception list by its human-readable list_id?”

Tell an agent

Get exception list {list_id}.

Show the details of exception list with id {id} in namespace {namespace_type}.

POST /api/exception_lists Create an exception list · Create an exception list #

Ask an LLM

“How do I create a new exception list for my detection rules?”

“Can I make an exception list that applies only to Windows endpoints?”

Tell an agent

Create an exception list named {name} of type {type} described as {description}.

Create exception list {list_id} called {name}, type {type}, description {description}, for OS types {os_types}.

PUT /api/exception_lists Update an exception list · Update an exception list #

Ask an LLM

“How do I rename an existing exception list or change its description?”

“Can I change the OS types or tags on an exception list I already made?”

Tell an agent

Update exception list {list_id} with name {name}, description {description} and type {type}.

Retag existing exception list {list_id} with {tags}, keeping name {name}, description {description}, type {type}.

POST /api/exception_lists/_duplicate Duplicate an exception list · Duplicate an exception list #

Ask an LLM

“Can I make a copy of an existing exception list?”

“Is it possible to leave out expired exceptions when copying a list?”

Tell an agent

Duplicate exception list {list_id} in namespace {namespace_type}, including expired items: {include_expired_exceptions}.

Copy list {list_id} ({namespace_type}) and include_expired_exceptions {include_expired_exceptions}.

POST /api/exception_lists/_export Export an exception list to a file · Export an exception list #

Ask an LLM

“How do I export an exception list and its items as NDJSON?”

“Can I back up an exception list without its expired items?”

Tell an agent

Export exception list {list_id} with id {id} in namespace {namespace_type}, include expired {include_expired_exceptions}.

Download list {list_id} (id {id}, {namespace_type}) as a file, expired items {include_expired_exceptions}.

GET /api/exception_lists/_find Search and list exception lists · Get exception lists #

Ask an LLM

“Which exception lists exist in my Kibana space?”

“Can I filter and sort exception lists and page through them?”

Tell an agent

List all exception lists.

Find exception lists matching {filter}, {per_page} per page.

POST /api/exception_lists/_import Import an exception list from a file · Import an exception list #

Ask an LLM

“How do I import exception lists from an exported NDJSON file?”

“Can I import a list as a new copy rather than overwriting the existing one?”

Tell an agent

Import exception lists from file {file}.

Import {file} and overwrite existing lists when overwrite is {overwrite}.

DELETE /api/exception_lists/items Delete an exception list item · Delete an exception list item #

Ask an LLM

“How do I remove one exception item from a list?”

“Can I delete an exception item using its item_id?”

Tell an agent destructive · confirm first

Delete exception item {item_id}.

Remove the exception list item with id {id} in namespace {namespace_type}.

GET /api/exception_lists/items Get an exception list item · Get an exception list item #

Ask an LLM

“What does a single exception item contain?”

“Can I look up an exception item by its item_id?”

Tell an agent

Get exception item {item_id}.

Show exception list item with id {id} in namespace {namespace_type}.

POST /api/exception_lists/items Add an item to an exception list · Create an exception list item #

Ask an LLM

“How do I add a new exception item to a shared exception list?”

“Can I add an entry to an existing list rather than to one rule?”

Tell an agent

Create a new item in an exception list.

Add an exception entry to a shared list.

PUT /api/exception_lists/items Update an exception list item · Update an exception list item #

Ask an LLM

“How do I change the conditions on an existing exception item?”

“Can I edit an exception item I already added to a list?”

Tell an agent

Update an existing exception list item.

Edit the entries of an exception item that's already in a list.

GET /api/exception_lists/items/_find List the items in an exception list · Get exception list items #

Ask an LLM

“What exceptions are inside a particular exception list?”

“Can I search within one list's exception items and page the results?”

Tell an agent

List the items in exception list {list_id}.

Search exception list {list_id} items for {search}.

GET /api/exception_lists/summary Summarize an exception list by OS · Get an exception list summary #

Ask an LLM

“How many exception items in a list apply to Windows, Linux or macOS?”

“Can I get item counts per operating system for an exception list?”

Tell an agent

Summarize exception list {list_id}.

Give me the per-OS item counts for list {list_id} filtered by {filter}.

POST /api/exceptions/shared Create a shared exception list · Create a shared exception list #

Ask an LLM

“How do I create a shared exception list that many rules can reference?”

“What do I need to provide to set up a shared exception list?”

Tell an agent

Create a shared exception list named {name} described as {description}.

Set up shared list {name} for reuse across rules, description {description}.

Elastic Stack (ELK Stack) Security Exceptions API

Operations 16

Documentation

Specifications

Other Resources

Work with this as data

MCP server

Tools for apis

Call it yourself

Get an API key

OpenAPI Specification