› › ›

查找异常项

编辑

查找异常项

编辑

检索指定容器中异常项的分页子集。默认情况下，将返回第一页，每页 20 个结果。

请求 URL

编辑

GET <kibana 主机>:<端口>/api/exception_lists/items/_find

URL 查询参数

编辑

名称	类型	描述	必填
`list_id`	字符串	异常容器的 ID。	是
`page`	整数	要返回的页码。	否
`per_page`	整数	每页要返回的项目数。	否
`sort_field`	字符串	确定用于对结果排序的字段。	否
`sort_order`	字符串	确定排序顺序，可以是 `desc` 或 `asc`。	否
`cursor`	字符串	返回上一次调用中返回的最后一个项目之后的项目（使用上一次调用中返回的 `cursor` 值）。此参数使用 `tie_breaker_id` 字段来确保所有项目都正确排序和返回。有关更多信息，请参阅 Search After。	否

示例请求

编辑

检索 allowed-processes 容器中的异常项

GET api/exception_lists/items/_find?list_id=allowed-processes

响应代码

编辑

200: 指示调用成功。

响应有效负载

编辑

{
  "data": [
    {
      "_tags": [],
      "comments": [
        {
          "comment": "Allowed on all hosts.",
          "created_at": "2020-07-14T13:40:39.804Z",
          "created_by": "elastic"
        }
      ],
      "created_at": "2020-07-14T13:40:39.804Z",
      "created_by": "elastic",
      "description": "Global process allowlist",
      "entries": [
        {
          "field": "process.name",
          "operator": "included",
          "type": "match",
          "value": "housekeeping"
        }
      ],
      "id": "9b25aec0-c5d7-11ea-a3d8-a5b753aeeb9e",
      "item_id": "global-allow-processes",
      "list_id": "allowed-processes",
      "name": "Host-process global exclusion",
      "namespace_type": "single",
      "tags": [
        "global",
        "hosts",
        "processes"
      ],
      "tie_breaker_id": "28c6b069-8e39-4f9a-b93c-95e5a15b46c5",
      "type": "simple",
      "updated_at": "2020-07-14T13:40:39.980Z",
      "updated_by": "elastic"
    },
    {
      "_tags": [],
      "comments": [
        {
          "comment": "Allows maintenance process to run on the specified machines",
          "created_at": "2020-07-14T13:41:24.005Z",
          "created_by": "elastic"
        }
      ],
      "created_at": "2020-07-14T13:41:24.005Z",
      "created_by": "elastic",
      "description": "Process allowlist",
      "entries": [
        {
          "field": "process.name",
          "operator": "included",
          "type": "match",
          "value": "maintenance"
        },
        {
          "field": "host.name",
          "operator": "included",
          "type": "match_any",
          "value": [
            "liv-win-anf",
            "livw-win-mel",
            "linux-anfield"
          ]
        }
      ],
      "id": "b57e5f60-c5d7-11ea-a3d8-a5b753aeeb9e",
      "item_id": "allow-process-on-machines",
      "list_id": "allowed-processes",
      "name": "Host-process exclusions",
      "namespace_type": "single",
      "tags": [
        "hosts",
        "processes"
      ],
      "tie_breaker_id": "a1bacb3d-7ce1-4f03-80f4-d49235b6bbde",
      "type": "simple",
      "updated_at": "2020-07-14T13:41:24.182Z",
      "updated_by": "elastic"
    }
  ],
  "page": 1,
  "per_page": 20,
  "total": 2
}

« 查找异常容器获取异常容器 »