--- title: "Create an exception list item" method: POST path: "/api/exception_lists/items" tags: ["Security Exceptions API"] --- # Create an exception list item `POST /api/exception_lists/items` **Spaces method and path for this operation:**
post /s/{space_id}/api/exception_lists/items
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Create an exception item and associate it with the specified exception list. > info > Before creating exception items, you must create an exception list. ## Request body - union - SecurityExceptionsAPICreateExceptionListItemGeneric - `comments` SecurityExceptionsAPICreateExceptionListItemComment[] - `comment` string, nonempty, required — A string that does not contain only whitespace characters - `description` string, required — Describes the exception list. - `expire_time` string, date-time — The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. - `item_id` string, nonempty — Human readable string identifier, e.g. `trusted-linux-processes` - `meta` SecurityExceptionsAPIExceptionListItemMeta - `name` string, nonempty, required — Exception list name. - `namespace_type` 'agnostic' | 'single' — Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where: - `single`: Only available in the Kibana space in which it is created. - `agnostic`: Available in all Kibana spaces. For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. - `type` 'simple', required - `entries` SecurityExceptionsAPIExceptionListItemEntry[], required - union - SecurityExceptionsAPIExceptionListItemEntryMatch - `field` string, nonempty, required — A string that does not contain only whitespace characters - `operator` 'excluded' | 'included', required - `type` 'match', required - `value` string, nonempty, required — A string that does not contain only whitespace characters - SecurityExceptionsAPIExceptionListItemEntryMatchAny - `field` string, nonempty, required — A string that does not contain only whitespace characters - `operator` 'excluded' | 'included', required - `type` 'match_any', required - `value` SecurityExceptionsAPINonEmptyString[], required - SecurityExceptionsAPIExceptionListItemEntryList - `field` string, nonempty, required — A string that does not contain only whitespace characters - `list` object, required - `id` string, nonempty, required — Value list's identifier. - `type` 'binary' | 'boolean' | 'byte' | 'date' | 'date_nanos' | 'date_range' | 'double' | 'double_range' | 'float' | 'float_range' | 'geo_point' | 'geo_shape' | 'half_float' | 'integer' | 'integer_range' | 'ip' | 'ip_range' | 'keyword' | 'long' | 'long_range' | 'shape' | 'short' | 'text', required — Specifies the Elasticsearch data type of excludes the list container holds. Some common examples: - `keyword`: Many ECS fields are Elasticsearch keywords - `ip`: IP addresses - `ip_range`: Range of IP addresses (supports IPv4, IPv6, and CIDR notation) - `operator` 'excluded' | 'included', required - `type` 'list', required - SecurityExceptionsAPIExceptionListItemEntryExists - `field` string, nonempty, required — A string that does not contain only whitespace characters - `operator` 'excluded' | 'included', required - `type` 'exists', required - SecurityExceptionsAPIExceptionListItemEntryNested - `entries` SecurityExceptionsAPIExceptionListItemEntryNestedEntryItem[], required - union - … - `field` string, nonempty, required — A string that does not contain only whitespace characters - `type` 'nested', required - SecurityExceptionsAPIExceptionListItemEntryMatchWildcard - `field` string, nonempty, required — A string that does not contain only whitespace characters - `operator` 'excluded' | 'included', required - `type` 'wildcard', required - `value` string, nonempty, required — A string that does not contain only whitespace characters - `list_id` string, nonempty, required — The exception list's human-readable string identifier. For endpoint artifacts, use one of the following values: * `endpoint_list`: Elastic Endpoint exceptions list * `endpoint_trusted_apps`: Trusted applications list * `endpoint_trusted_devices`: Trusted devices list * `endpoint_event_filters`: Event filters list * `endpoint_host_isolation_exceptions`: Host isolation exceptions list * `endpoint_blocklists`: Blocklist - `os_types` SecurityExceptionsAPIExceptionListOsType[] - `tags` string[] - SecurityExceptionsAPICreateExceptionListItemEndpointList — Elastic Endpoint exception list item properties. - `comments` SecurityExceptionsAPICreateExceptionListItemComment[] - `comment` string, nonempty, required — A string that does not contain only whitespace characters - `description` string, required — Describes the exception list. - `expire_time` string, date-time — The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. - `item_id` string, nonempty — Human readable string identifier, e.g. `trusted-linux-processes` - `meta` SecurityExceptionsAPIExceptionListItemMeta - `name` string, nonempty, required — Exception list name. - `namespace_type` 'agnostic' | 'single' — Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where: - `single`: Only available in the Kibana space in which it is created. - `agnostic`: Available in all Kibana spaces. For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. - `type` 'simple', required - `entries` SecurityExceptionsAPIExceptionListItemEntry[] - union - SecurityExceptionsAPIExceptionListItemEntryMatch - `field` string, nonempty, required — A string that does not contain only whitespace characters - `operator` 'excluded' | 'included', required - `type` 'match', required - `value` string, nonempty, required — A string that does not contain only whitespace characters - SecurityExceptionsAPIExceptionListItemEntryMatchAny - `field` string, nonempty, required — A string that does not contain only whitespace characters - `operator` 'excluded' | 'included', required - `type` 'match_any', required - `value` SecurityExceptionsAPINonEmptyString[], required - SecurityExceptionsAPIExceptionListItemEntryList - `field` string, nonempty, required — A string that does not contain only whitespace characters - `list` object, required - `id` string, nonempty, required — Value list's identifier. - `type` 'binary' | 'boolean' | 'byte' | 'date' | 'date_nanos' | 'date_range' | 'double' | 'double_range' | 'float' | 'float_range' | 'geo_point' | 'geo_shape' | 'half_float' | 'integer' | 'integer_range' | 'ip' | 'ip_range' | 'keyword' | 'long' | 'long_range' | 'shape' | 'short' | 'text', required — Specifies the Elasticsearch data type of excludes the list container holds. Some common examples: - `keyword`: Many ECS fields are Elasticsearch keywords - `ip`: IP addresses - `ip_range`: Range of IP addresses (supports IPv4, IPv6, and CIDR notation) - `operator` 'excluded' | 'included', required - `type` 'list', required - SecurityExceptionsAPIExceptionListItemEntryExists - `field` string, nonempty, required — A string that does not contain only whitespace characters - `operator` 'excluded' | 'included', required - `type` 'exists', required - SecurityExceptionsAPIExceptionListItemEntryNested - `entries` SecurityExceptionsAPIExceptionListItemEntryNestedEntryItem[], required - union - … - `field` string, nonempty, required — A string that does not contain only whitespace characters - `type` 'nested', required - SecurityExceptionsAPIExceptionListItemEntryMatchWildcard - `field` string, nonempty, required — A string that does not contain only whitespace characters - `operator` 'excluded' | 'included', required - `type` 'wildcard', required - `value` string, nonempty, required — A string that does not contain only whitespace characters - `list_id` 'endpoint_list', required - `os_types` SecurityExceptionsAPIExceptionListOsType[] - `tags` string[] — Tags for categorization. Special tags for scope control: * `"policy:all"` - Global artifact (applies to all Elastic Defend policies) * `"policy:"` - Private artifact (applies to specific Elastic Defend policy only, where `` is the Elastic Defend integration policy ID) - SecurityExceptionsAPICreateExceptionListItemTrustedAppsWindows — Trusted applications list item properties (Windows). - `comments` SecurityExceptionsAPICreateExceptionListItemComment[] - `comment` string, nonempty, required — A string that does not contain only whitespace characters - `description` string, required — Describes the exception list. - `expire_time` string, date-time — The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. - `item_id` string, nonempty — Human readable string identifier, e.g. `trusted-linux-processes` - `meta` SecurityExceptionsAPIExceptionListItemMeta - `name` string, nonempty, required — Exception list name. - `namespace_type` 'agnostic' | 'single' — Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where: - `single`: Only available in the Kibana space in which it is created. - `agnostic`: Available in all Kibana spaces. For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. - `type` 'simple', required - `entries` union[] — Process hash, executable path, or code signature entries - union - SecurityExceptionsAPITrustedAppHashEntry - `field` 'process.hash.md5' | 'process.hash.sha1' | 'process.hash.sha256', required — Process hash field - `operator` 'included', required - `type` 'match', required — Hash entries only support match type - `value` string, required — Hash value (MD5, SHA1, or SHA256) - SecurityExceptionsAPITrustedAppPathEntry - `field` 'process.executable.caseless', required — Process executable path field - `operator` 'included', required - `type` 'match' | 'wildcard', required — Path supports both match and wildcard types - `value` string, required — Executable path - SecurityExceptionsAPITrustedAppWindowsCodeSignatureEntry - `entries` union[], required — Must include exactly 2 entries - one for subject_name and one for trusted - union - … - `field` 'process.Ext.code_signature', required — Windows code signature field - `type` 'nested', required - `list_id` 'endpoint_trusted_apps', required - `os_types` string[] — Must be Windows only - `tags` string[] — Tags for categorization. Special tags for scope control: * `"policy:all"` - Global artifact (applies to all Elastic Defend policies) * `"policy:"` - Private artifact (applies to specific Elastic Defend policy only, where `` is the Elastic Defend integration policy ID) - SecurityExceptionsAPICreateExceptionListItemTrustedAppsMac — Trusted applications list item properties (macOS). - `comments` SecurityExceptionsAPICreateExceptionListItemComment[] - `comment` string, nonempty, required — A string that does not contain only whitespace characters - `description` string, required — Describes the exception list. - `expire_time` string, date-time — The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. - `item_id` string, nonempty — Human readable string identifier, e.g. `trusted-linux-processes` - `meta` SecurityExceptionsAPIExceptionListItemMeta - `name` string, nonempty, required — Exception list name. - `namespace_type` 'agnostic' | 'single' — Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where: - `single`: Only available in the Kibana space in which it is created. - `agnostic`: Available in all Kibana spaces. For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. - `type` 'simple', required - `entries` union[] — Process hash, executable path, or code signature entries - union - SecurityExceptionsAPITrustedAppHashEntry - `field` 'process.hash.md5' | 'process.hash.sha1' | 'process.hash.sha256', required — Process hash field - `operator` 'included', required - `type` 'match', required — Hash entries only support match type - `value` string, required — Hash value (MD5, SHA1, or SHA256) - SecurityExceptionsAPITrustedAppPathEntry - `field` 'process.executable.caseless', required — Process executable path field - `operator` 'included', required - `type` 'match' | 'wildcard', required — Path supports both match and wildcard types - `value` string, required — Executable path - SecurityExceptionsAPITrustedAppMacCodeSignatureEntry - `entries` union[], required — Must include exactly 2 entries - one for subject_name and one for trusted - union - … - `field` 'process.code_signature', required — macOS code signature field - `type` 'nested', required - `list_id` 'endpoint_trusted_apps', required - `os_types` string[] — Must be macOS only - `tags` string[] — Tags for categorization. Special tags for scope control: * `"policy:all"` - Global artifact (applies to all Elastic Defend policies) * `"policy:"` - Private artifact (applies to specific Elastic Defend policy only, where `` is the Elastic Defend integration policy ID) - SecurityExceptionsAPICreateExceptionListItemTrustedAppsLinux — Trusted applications list item properties (Linux). - `comments` SecurityExceptionsAPICreateExceptionListItemComment[] - `comment` string, nonempty, required — A string that does not contain only whitespace characters - `description` string, required — Describes the exception list. - `expire_time` string, date-time — The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. - `item_id` string, nonempty — Human readable string identifier, e.g. `trusted-linux-processes` - `meta` SecurityExceptionsAPIExceptionListItemMeta - `name` string, nonempty, required — Exception list name. - `namespace_type` 'agnostic' | 'single' — Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where: - `single`: Only available in the Kibana space in which it is created. - `agnostic`: Available in all Kibana spaces. For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. - `type` 'simple', required - `entries` union[] — Process hash or executable path entries (code signature not supported on Linux) - union - SecurityExceptionsAPITrustedAppHashEntry - `field` 'process.hash.md5' | 'process.hash.sha1' | 'process.hash.sha256', required — Process hash field - `operator` 'included', required - `type` 'match', required — Hash entries only support match type - `value` string, required — Hash value (MD5, SHA1, or SHA256) - SecurityExceptionsAPITrustedAppPathEntry - `field` 'process.executable.caseless', required — Process executable path field - `operator` 'included', required - `type` 'match' | 'wildcard', required — Path supports both match and wildcard types - `value` string, required — Executable path - `list_id` 'endpoint_trusted_apps', required - `os_types` string[] — Must be Linux only - `tags` string[] — Tags for categorization. Special tags for scope control: * `"policy:all"` - Global artifact (applies to all Elastic Defend policies) * `"policy:"` - Private artifact (applies to specific Elastic Defend policy only, where `` is the Elastic Defend integration policy ID) - SecurityExceptionsAPICreateExceptionListItemTrustedDevicesWindows — Trusted devices list item properties (Windows-only, allows username field). - `comments` SecurityExceptionsAPICreateExceptionListItemComment[] - `comment` string, nonempty, required — A string that does not contain only whitespace characters - `description` string, required — Describes the exception list. - `expire_time` string, date-time — The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. - `item_id` string, nonempty — Human readable string identifier, e.g. `trusted-linux-processes` - `meta` SecurityExceptionsAPIExceptionListItemMeta - `name` string, nonempty, required — Exception list name. - `namespace_type` 'agnostic' | 'single' — Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where: - `single`: Only available in the Kibana space in which it is created. - `agnostic`: Available in all Kibana spaces. For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. - `type` 'simple', required - `entries` object[] — Exception entries for the trusted device (duplicate field entries are not allowed) - `field` 'device.serial_number' | 'device.type' | 'host.name' | 'device.vendor.name' | 'device.vendor.id' | 'device.product.id' | 'device.product.name' | 'user.name', required — Device field to match against (user.name is Windows-only) - `operator` 'included', required — Must be the value "included" - `type` 'match' | 'wildcard' | 'match_any', required — Entry match type - `value` union, required - string — Single value (used with match or wildcard) - string[] — Array of values (used with match_any) - `list_id` 'endpoint_trusted_devices', required - `os_types` string[] — Must be Windows-only to allow username field - `tags` string[] — Tags for categorization. Special tags for scope control: * `"policy:all"` - Global artifact (applies to all Elastic Defend policies) * `"policy:"` - Private artifact (applies to specific Elastic Defend policy only, where `` is the Elastic Defend integration policy ID) - SecurityExceptionsAPICreateExceptionListItemTrustedDevicesMac — Trusted devices list item properties (macOS-only, username not supported). - `comments` SecurityExceptionsAPICreateExceptionListItemComment[] - `comment` string, nonempty, required — A string that does not contain only whitespace characters - `description` string, required — Describes the exception list. - `expire_time` string, date-time — The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. - `item_id` string, nonempty — Human readable string identifier, e.g. `trusted-linux-processes` - `meta` SecurityExceptionsAPIExceptionListItemMeta - `name` string, nonempty, required — Exception list name. - `namespace_type` 'agnostic' | 'single' — Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where: - `single`: Only available in the Kibana space in which it is created. - `agnostic`: Available in all Kibana spaces. For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. - `type` 'simple', required - `entries` object[] — Exception entries for the trusted device (duplicate field entries are not allowed) - `field` 'device.serial_number' | 'device.type' | 'host.name' | 'device.vendor.name' | 'device.vendor.id' | 'device.product.id' | 'device.product.name', required — Device field to match against - `operator` 'included', required — Must be the value "included" - `type` 'match' | 'wildcard' | 'match_any', required — Entry match type - `value` union, required - string — Single value (used with match or wildcard) - string[] — Array of values (used with match_any) - `list_id` 'endpoint_trusted_devices', required - `os_types` string[] — macOS-only - `tags` string[] — Tags for categorization. Special tags for scope control: * `"policy:all"` - Global artifact (applies to all Elastic Defend policies) * `"policy:"` - Private artifact (applies to specific Elastic Defend policy only, where `` is the Elastic Defend integration policy ID) - SecurityExceptionsAPICreateExceptionListItemTrustedDevicesWindowsMac — Trusted devices list item properties (Windows + macOS, username not supported). - `comments` SecurityExceptionsAPICreateExceptionListItemComment[] - `comment` string, nonempty, required — A string that does not contain only whitespace characters - `description` string, required — Describes the exception list. - `expire_time` string, date-time — The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. - `item_id` string, nonempty — Human readable string identifier, e.g. `trusted-linux-processes` - `meta` SecurityExceptionsAPIExceptionListItemMeta - `name` string, nonempty, required — Exception list name. - `namespace_type` 'agnostic' | 'single' — Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where: - `single`: Only available in the Kibana space in which it is created. - `agnostic`: Available in all Kibana spaces. For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. - `type` 'simple', required - `entries` object[] — Exception entries for the trusted device (duplicate field entries are not allowed, username not available when targeting both OS) - `field` 'device.serial_number' | 'device.type' | 'host.name' | 'device.vendor.name' | 'device.vendor.id' | 'device.product.id' | 'device.product.name', required — Device field to match against (username not available for multi-OS) - `operator` 'included', required — Must be the value "included" - `type` 'match' | 'wildcard' | 'match_any', required — Entry match type - `value` union, required - string — Single value (used with match or wildcard) - string[] — Array of values (used with match_any) - `list_id` 'endpoint_trusted_devices', required - `os_types` string[] — Must include both Windows and macOS (username field not allowed) - `tags` string[] — Tags for categorization. Special tags for scope control: * `"policy:all"` - Global artifact (applies to all Elastic Defend policies) * `"policy:"` - Private artifact (applies to specific Elastic Defend policy only, where `` is the Elastic Defend integration policy ID) - SecurityExceptionsAPICreateExceptionListItemEventFilters — Event filters list item properties. - `comments` SecurityExceptionsAPICreateExceptionListItemComment[] - `comment` string, nonempty, required — A string that does not contain only whitespace characters - `description` string, required — Describes the exception list. - `expire_time` string, date-time — The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. - `item_id` string, nonempty — Human readable string identifier, e.g. `trusted-linux-processes` - `meta` SecurityExceptionsAPIExceptionListItemMeta - `name` string, nonempty, required — Exception list name. - `namespace_type` 'agnostic' | 'single' — Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where: - `single`: Only available in the Kibana space in which it is created. - `agnostic`: Available in all Kibana spaces. For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. - `type` 'simple', required - `entries` SecurityExceptionsAPIExceptionListItemEntry[] - union - SecurityExceptionsAPIExceptionListItemEntryMatch - `field` string, nonempty, required — A string that does not contain only whitespace characters - `operator` 'excluded' | 'included', required - `type` 'match', required - `value` string, nonempty, required — A string that does not contain only whitespace characters - SecurityExceptionsAPIExceptionListItemEntryMatchAny - `field` string, nonempty, required — A string that does not contain only whitespace characters - `operator` 'excluded' | 'included', required - `type` 'match_any', required - `value` SecurityExceptionsAPINonEmptyString[], required - SecurityExceptionsAPIExceptionListItemEntryList - `field` string, nonempty, required — A string that does not contain only whitespace characters - `list` object, required - `id` string, nonempty, required — Value list's identifier. - `type` 'binary' | 'boolean' | 'byte' | 'date' | 'date_nanos' | 'date_range' | 'double' | 'double_range' | 'float' | 'float_range' | 'geo_point' | 'geo_shape' | 'half_float' | 'integer' | 'integer_range' | 'ip' | 'ip_range' | 'keyword' | 'long' | 'long_range' | 'shape' | 'short' | 'text', required — Specifies the Elasticsearch data type of excludes the list container holds. Some common examples: - `keyword`: Many ECS fields are Elasticsearch keywords - `ip`: IP addresses - `ip_range`: Range of IP addresses (supports IPv4, IPv6, and CIDR notation) - `operator` 'excluded' | 'included', required - `type` 'list', required - SecurityExceptionsAPIExceptionListItemEntryExists - `field` string, nonempty, required — A string that does not contain only whitespace characters - `operator` 'excluded' | 'included', required - `type` 'exists', required - SecurityExceptionsAPIExceptionListItemEntryNested - `entries` SecurityExceptionsAPIExceptionListItemEntryNestedEntryItem[], required - union - … - `field` string, nonempty, required — A string that does not contain only whitespace characters - `type` 'nested', required - SecurityExceptionsAPIExceptionListItemEntryMatchWildcard - `field` string, nonempty, required — A string that does not contain only whitespace characters - `operator` 'excluded' | 'included', required - `type` 'wildcard', required - `value` string, nonempty, required — A string that does not contain only whitespace characters - `list_id` 'endpoint_event_filters', required - `os_types` SecurityExceptionsAPIExceptionListOsType[] - `tags` string[] — Tags for categorization. Special tags for scope control: * `"policy:all"` - Global artifact (applies to all Elastic Defend policies) * `"policy:"` - Private artifact (applies to specific Elastic Defend policy only, where `` is the Elastic Defend integration policy ID) - SecurityExceptionsAPICreateExceptionListItemHostIsolation — Host isolation exceptions list item properties. - `comments` SecurityExceptionsAPICreateExceptionListItemComment[] - `comment` string, nonempty, required — A string that does not contain only whitespace characters - `description` string, required — Describes the exception list. - `expire_time` string, date-time — The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. - `item_id` string, nonempty — Human readable string identifier, e.g. `trusted-linux-processes` - `meta` SecurityExceptionsAPIExceptionListItemMeta - `name` string, nonempty, required — Exception list name. - `namespace_type` 'agnostic' | 'single' — Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where: - `single`: Only available in the Kibana space in which it is created. - `agnostic`: Available in all Kibana spaces. For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. - `type` 'simple', required - `entries` object[] — Exactly one entry allowed for host isolation exceptions - `field` 'destination.ip', required — Must be destination.ip - `operator` 'included', required — Must be the value "included" - `type` 'match', required — Must be match - `value` string, required — Valid IPv4 address or CIDR notation (e.g., "192.168.1.1" or "10.0.0.0/8") - `list_id` 'endpoint_host_isolation_exceptions', required - `os_types` string[] — Must include all three operating systems (windows, linux, macos) - `tags` string[] — Tags for categorization. Special tags for scope control: * `"policy:all"` - Global artifact (applies to all Elastic Defend policies) * `"policy:"` - Private artifact (applies to specific Elastic Defend policy only, where `` is the Elastic Defend integration policy ID) - SecurityExceptionsAPICreateExceptionListItemBlocklistWindows — Blocklist list item properties (Windows, supports code signature). - `comments` SecurityExceptionsAPICreateExceptionListItemComment[] - `comment` string, nonempty, required — A string that does not contain only whitespace characters - `description` string, required — Describes the exception list. - `expire_time` string, date-time — The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. - `item_id` string, nonempty — Human readable string identifier, e.g. `trusted-linux-processes` - `meta` SecurityExceptionsAPIExceptionListItemMeta - `name` string, nonempty, required — Exception list name. - `namespace_type` 'agnostic' | 'single' — Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where: - `single`: Only available in the Kibana space in which it is created. - `agnostic`: Available in all Kibana spaces. For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. - `type` 'simple', required - `entries` union[] — **Validation rules:** * Hash entries: up to 3 (one for each hash type: md5, sha1, sha256) * Path entry: only 1 allowed * Code signature entry: only 1 allowed - union - SecurityExceptionsAPIBlocklistHashOrPathEntry - `field` 'file.hash.md5' | 'file.hash.sha1' | 'file.hash.sha256' | 'file.path' | 'file.path.caseless', required — File hash or path field - `operator` 'included', required — Must be the value "included" - `type` 'match_any', required — Must be match_any for blocklists - `value` string[], required — Array of hash values or file paths - SecurityExceptionsAPIBlocklistWindowsCodeSignatureEntry - `entries` object[], required — Nested subject_name entries - `field` 'subject_name', required — Certificate subject name - `operator` 'included', required — Must be the value "included" - `type` 'match' | 'match_any', required — Match type for subject name - `value` union, required - … - `field` 'file.Ext.code_signature', required — Windows code signature field - `type` 'nested', required — Must be nested for Windows code signature - `list_id` 'endpoint_blocklists', required - `os_types` string[] — Windows-only - `tags` string[] — Tags for categorization. Special tags for scope control: * `"policy:all"` - Global artifact (applies to all Elastic Defend policies) * `"policy:"` - Private artifact (applies to specific Elastic Defend policy only, where `` is the Elastic Defend integration policy ID) - SecurityExceptionsAPICreateExceptionListItemBlocklistLinux — Blocklist list item properties (Linux, code signature not supported). - `comments` SecurityExceptionsAPICreateExceptionListItemComment[] - `comment` string, nonempty, required — A string that does not contain only whitespace characters - `description` string, required — Describes the exception list. - `expire_time` string, date-time — The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. - `item_id` string, nonempty — Human readable string identifier, e.g. `trusted-linux-processes` - `meta` SecurityExceptionsAPIExceptionListItemMeta - `name` string, nonempty, required — Exception list name. - `namespace_type` 'agnostic' | 'single' — Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where: - `single`: Only available in the Kibana space in which it is created. - `agnostic`: Available in all Kibana spaces. For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. - `type` 'simple', required - `entries` SecurityExceptionsAPIBlocklistHashOrPathEntry[] — **Validation rules:** * Hash entries: up to 3 (one for each hash type: md5, sha1, sha256) * Path entry: only 1 allowed - `field` 'file.hash.md5' | 'file.hash.sha1' | 'file.hash.sha256' | 'file.path' | 'file.path.caseless', required — File hash or path field - `operator` 'included', required — Must be the value "included" - `type` 'match_any', required — Must be match_any for blocklists - `value` string[], required — Array of hash values or file paths - `list_id` 'endpoint_blocklists', required - `os_types` string[] — Linux-only - `tags` string[] — Tags for categorization. Special tags for scope control: * `"policy:all"` - Global artifact (applies to all Elastic Defend policies) * `"policy:"` - Private artifact (applies to specific Elastic Defend policy only, where `` is the Elastic Defend integration policy ID) - SecurityExceptionsAPICreateExceptionListItemBlocklistMac — Blocklist list item properties (macOS, code signature not supported). - `comments` SecurityExceptionsAPICreateExceptionListItemComment[] - `comment` string, nonempty, required — A string that does not contain only whitespace characters - `description` string, required — Describes the exception list. - `expire_time` string, date-time — The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. - `item_id` string, nonempty — Human readable string identifier, e.g. `trusted-linux-processes` - `meta` SecurityExceptionsAPIExceptionListItemMeta - `name` string, nonempty, required — Exception list name. - `namespace_type` 'agnostic' | 'single' — Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where: - `single`: Only available in the Kibana space in which it is created. - `agnostic`: Available in all Kibana spaces. For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. - `type` 'simple', required - `entries` SecurityExceptionsAPIBlocklistHashOrPathEntry[] — **Validation rules:** * Hash entries: up to 3 (one for each hash type: md5, sha1, sha256) * Path entry: only 1 allowed - `field` 'file.hash.md5' | 'file.hash.sha1' | 'file.hash.sha256' | 'file.path' | 'file.path.caseless', required — File hash or path field - `operator` 'included', required — Must be the value "included" - `type` 'match_any', required — Must be match_any for blocklists - `value` string[], required — Array of hash values or file paths - `list_id` 'endpoint_blocklists', required - `os_types` string[] — macOS-only - `tags` string[] — Tags for categorization. Special tags for scope control: * `"policy:all"` - Global artifact (applies to all Elastic Defend policies) * `"policy:"` - Private artifact (applies to specific Elastic Defend policy only, where `` is the Elastic Defend integration policy ID) ## Response `200` Successful response - SecurityExceptionsAPIExceptionListItem - `_version` string — The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version. - `comments` SecurityExceptionsAPIExceptionListItemComment[], required — Array of comment fields: - comment (string): Comments about the exception item. - `comment` string, nonempty, required — A string that does not contain only whitespace characters - `created_at` string, date-time, required — Autogenerated date of object creation. - `created_by` string, nonempty, required — A string that does not contain only whitespace characters - `id` string, nonempty, required — A string that does not contain only whitespace characters - `updated_at` string, date-time — Autogenerated date of last object update. - `updated_by` string, nonempty — A string that does not contain only whitespace characters - `created_at` string, date-time, required — Autogenerated date of object creation. - `created_by` string, required — Autogenerated value - user that created object. - `description` string, required — Describes the exception list. - `entries` SecurityExceptionsAPIExceptionListItemEntry[], required - union - SecurityExceptionsAPIExceptionListItemEntryMatch - `field` string, nonempty, required — A string that does not contain only whitespace characters - `operator` 'excluded' | 'included', required - `type` 'match', required - `value` string, nonempty, required — A string that does not contain only whitespace characters - SecurityExceptionsAPIExceptionListItemEntryMatchAny - `field` string, nonempty, required — A string that does not contain only whitespace characters - `operator` 'excluded' | 'included', required - `type` 'match_any', required - `value` SecurityExceptionsAPINonEmptyString[], required - SecurityExceptionsAPIExceptionListItemEntryList - `field` string, nonempty, required — A string that does not contain only whitespace characters - `list` object, required - `id` string, nonempty, required — Value list's identifier. - `type` 'binary' | 'boolean' | 'byte' | 'date' | 'date_nanos' | 'date_range' | 'double' | 'double_range' | 'float' | 'float_range' | 'geo_point' | 'geo_shape' | 'half_float' | 'integer' | 'integer_range' | 'ip' | 'ip_range' | 'keyword' | 'long' | 'long_range' | 'shape' | 'short' | 'text', required — Specifies the Elasticsearch data type of excludes the list container holds. Some common examples: - `keyword`: Many ECS fields are Elasticsearch keywords - `ip`: IP addresses - `ip_range`: Range of IP addresses (supports IPv4, IPv6, and CIDR notation) - `operator` 'excluded' | 'included', required - `type` 'list', required - SecurityExceptionsAPIExceptionListItemEntryExists - `field` string, nonempty, required — A string that does not contain only whitespace characters - `operator` 'excluded' | 'included', required - `type` 'exists', required - SecurityExceptionsAPIExceptionListItemEntryNested - `entries` SecurityExceptionsAPIExceptionListItemEntryNestedEntryItem[], required - union - SecurityExceptionsAPIExceptionListItemEntryMatch - … - SecurityExceptionsAPIExceptionListItemEntryMatchAny - … - SecurityExceptionsAPIExceptionListItemEntryExists - … - `field` string, nonempty, required — A string that does not contain only whitespace characters - `type` 'nested', required - SecurityExceptionsAPIExceptionListItemEntryMatchWildcard - `field` string, nonempty, required — A string that does not contain only whitespace characters - `operator` 'excluded' | 'included', required - `type` 'wildcard', required - `value` string, nonempty, required — A string that does not contain only whitespace characters - `expire_time` string, date-time — The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. - `id` string, nonempty, required — Exception's identifier. - `item_id` string, nonempty, required — Human readable string identifier, e.g. `trusted-linux-processes` - `list_id` string, nonempty, required — The exception list's human-readable string identifier. For endpoint artifacts, use one of the following values: * `endpoint_list`: Elastic Endpoint exceptions list * `endpoint_trusted_apps`: Trusted applications list * `endpoint_trusted_devices`: Trusted devices list * `endpoint_event_filters`: Event filters list * `endpoint_host_isolation_exceptions`: Host isolation exceptions list * `endpoint_blocklists`: Blocklist - `meta` SecurityExceptionsAPIExceptionListItemMeta - `name` string, nonempty, required — Exception list name. - `namespace_type` 'agnostic' | 'single', required — Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where: - `single`: Only available in the Kibana space in which it is created. - `agnostic`: Available in all Kibana spaces. For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments. - `os_types` SecurityExceptionsAPIExceptionListOsType[] - `tags` string[] - `tie_breaker_id` string, required — Field used in search to ensure all containers are sorted and returned correctly. - `type` 'simple', required - `updated_at` string, date-time, required — Autogenerated date of last object update. - `updated_by` string, required — Autogenerated value - user that last updated object. ## Other responses - `400` — Invalid input data response - `401` — Unsuccessful authentication response - `403` — Not enough privileges response - `409` — Exception list item already exists response - `500` — Internal server error response --- [API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)