Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding exceptions list export route documentation #3061

Closed
dplumlee opened this issue Mar 22, 2023 · 0 comments · Fixed by #4360 or #4316
Closed

Adding exceptions list export route documentation #3061

dplumlee opened this issue Mar 22, 2023 · 0 comments · Fixed by #4360 or #4316
Assignees
Labels
API Effort: Medium Issues that take moderate but not substantial time to complete Feature: Exceptions Priority: Medium Issues that have relevance, but aren't urgent Team: Security Platform Includes Cyber Threat Intelligence (CTI) team

Comments

@dplumlee
Copy link
Contributor

Description

The documentation seems to be missing for our exception list export which was added (I believe) in this PR dating back all the way to some 7.x builds. We should add this in and backport it to the relevant releases. From what I can tell, the route and its query parameters have remained the same since it was written, but we added another query parameter in the exceptions TTL PR which should be reflected only in the 8.7 docs version

This route itself exports an exception list by providing an exception list ID and the list is exported into an .ndjson format. Exception lists consist of two elements - the list itself, and its items. The export file should now contain both these elements, the list followed by its items. The first PR link has examples of exported lists.

The route, following the current docs format, should be POST <kibana host>:<port>/api/exception_lists/_export

The query parameters are

{
  id: string // The exception list id
  list_id: string // The exception list list_id
  namespace_type: "agnostic" | "single" // The exception list namespace_type
  
  (for 8.7+ only)
  include_expired_exceptions: (optional) boolean // whether or not to include expired exceptions in the exported list (defaults to true)
}

So an example request would be

POST api/exception_lists/_export?id=test_id&list_id=test_list_id&namespace_type=agnostic

with the response being an aforementioned .ndjson file

@dplumlee dplumlee added documentation Improvements or additions to documentation Feature: Exceptions labels Mar 22, 2023
@nastasha-solomon nastasha-solomon self-assigned this Mar 22, 2023
@nastasha-solomon nastasha-solomon added Team: Security Platform Includes Cyber Threat Intelligence (CTI) team and removed documentation Improvements or additions to documentation labels Apr 20, 2023
@nastasha-solomon nastasha-solomon added this to To do in Elastic Security Docs Board via automation Apr 20, 2023
@nastasha-solomon nastasha-solomon added Effort: Medium Issues that take moderate but not substantial time to complete Priority: Medium Issues that have relevance, but aren't urgent labels Aug 6, 2023
@natasha-moore-elastic natasha-moore-elastic self-assigned this Nov 23, 2023
@natasha-moore-elastic natasha-moore-elastic linked a pull request Dec 1, 2023 that will close this issue
@nastasha-solomon nastasha-solomon removed their assignment Dec 2, 2023
Elastic Security Docs Board automation moved this from To do to Done Dec 5, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
API Effort: Medium Issues that take moderate but not substantial time to complete Feature: Exceptions Priority: Medium Issues that have relevance, but aren't urgent Team: Security Platform Includes Cyber Threat Intelligence (CTI) team
3 participants