Query parameters

• id string(nonempty) Required

  Value list's identifier.

  Minimum length is 1.

• deleteReferences boolean

  Determines whether exception items referencing this value list should be deleted.

  Default value is false.

• ignoreReferences boolean

  Determines whether to delete value list without performing any additional checks of where this list may be utilized.

  Default value is false.

Responses

• 200 application/json

  Successful response

  Hide response attributes Show response attributes object

  • _version string

    The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.

  • @timestamp string(date-time)
  • created_at string(date-time) Required

    Autogenerated date of object creation.

  • created_by string Required

    Autogenerated value - user that created object.

  • description string(nonempty) Required

    Describes the value list.

    Minimum length is 1.

  • deserializer string

    Determines how retrieved list item values are presented. By default list items are presented using these Handelbar expressions:

    • {{{value}}} - Single value item types, such as ip, long, date, keyword, and text.
    • {{{gte}}}-{{{lte}}} - Range value item types, such as ip_range, double_range, float_range, integer_range, and long_range.
    • {{{gte}}},{{{lte}}} - Date range values.
  • id string(nonempty) Required

    Value list's identifier.

    Minimum length is 1.

  • immutable boolean Required
  • meta object

    Placeholder for metadata about the value list.

    Additional properties are allowed.

  • name string(nonempty) Required

    Value list's name.

    Minimum length is 1.

  • serializer string

    Determines how uploaded list item values are parsed. By default, list items are parsed using these named regex groups:

    • (?<value>.+) - Single value item types, such as ip, long, date, keyword, and text.
    • (?<gte>.+)-(?<lte>.+)|(?<value>.+) - Range value item types, such as date_range, ip_range, double_range, float_range, integer_range, and long_range.
  • tie_breaker_id string Required

    Field used in search to ensure all containers are sorted and returned correctly.

  • type string Required

    Specifies the Elasticsearch data type of excludes the list container holds. Some common examples:

    • keyword: Many ECS fields are Elasticsearch keywords
    • ip: IP addresses
    • ip_range: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)

    Values are binary, boolean, byte, date, date_nanos, date_range, double, double_range, float, float_range, geo_point, geo_shape, half_float, integer, integer_range, ip, ip_range, keyword, long, long_range, shape, short, or text.

  • updated_at string(date-time) Required

    Autogenerated date of last object update.

  • updated_by string Required

    Autogenerated value - user that last updated object.

  • version integer Required

    The document version number.

    Minimum value is 1.

• 400 application/json

  Invalid input data response

  One of:

  Security_Lists_API_PlatformErrorResponse object Security_Lists_API_SiemErrorResponse object

  Hide attributes Show attributes

  • error string Required
  • message string Required
  • statusCode integer Required

  Hide attributes Show attributes

  • message string Required
  • status_code integer Required
• 401 application/json

  Unsuccessful authentication response

  Hide response attributes Show response attributes object

  • error string Required
  • message string Required
  • statusCode integer Required
• 403 application/json

  Not enough privileges response

  Hide response attributes Show response attributes object

  • error string Required
  • message string Required
  • statusCode integer Required
• 404 application/json

  List not found response

  Hide response attributes Show response attributes object

  • message string Required
  • status_code integer Required
• 500 application/json

  Internal server error response

  Hide response attributes Show response attributes object

  • message string Required
  • status_code integer Required