获取异常容器
编辑获取异常容器编辑
使用其 id 或 list_id 字段检索异常容器。
请求 URL编辑
GET <kibana 主机>:<端口>/api/exception_lists
URL 查询参数编辑
URL 查询必须包含容器的 id 或 list_id
-
id-GET /api/exception_lists?id=<id> -
list_id-GET /api/exception_lists?list_id=<list_id>
响应代码编辑
-
200 - 表示成功调用。
响应有效载荷编辑
{
"_tags": [],
"created_at": "2020-07-14T08:24:22.884Z",
"created_by": "elastic",
"description": "Excludes trusted processes",
"id": "6c03f6a0-c5ab-11ea-a3d8-a5b753aeeb9e",
"list_id": "allowed-processes",
"name": "Process exceptions",
"namespace_type": "single",
"tags": [
"hosts",
"processes"
],
"tie_breaker_id": "65e16c8a-0d45-4e38-8a8f-094658a5df90",
"type": "detection",
"updated_at": "2020-07-14T08:24:23.050Z",
"updated_by": "elastic"
}