Hello to everyone. I'm exploring Elastic Defend in a self-hosted cluster with Basic license. I have a question: if i add a Rule Exception (without using Shared Exceptions Lists), is there a way to list all exceptions created or to list all rules that have exceptions configured? I'm asking this be…

Thank you for your answer. As a workaround, is there maybe a query that i can execute directly on Elasticsearch, that allow me to see all exclusions?

hey @aptfinf You can use this API to find all exception containers Results would have shared lists and exception container applied to a single rule. To filter out exceptions applied to a single rule use filter in query exception_lists/_find?filter=(exception-list.attributes.type%3Arule_default) …

List all Rules Exceptions

Elastic Security SIEM

Kseniiaign (Kseniia Ignatovych) August 29, 2024, 11:46am 2

Hi @aptfinf , it is not possible at the moment, but it is something we plan to address. Thanks for the question.

1 Like

Topic		Replies	Views
Elastic SIEM Detections Elastic Security	3	308	December 27, 2023
Can't use exception lists Elastic Security	5	637	April 19, 2022
Issues with Exception lists automatically combining rules Elastic Security	6	597	February 16, 2023
No exception lists found Endpoint Security	17	1646	October 12, 2022
Backup Detection Rules and Exceptions Elasticsearch detection-rules	1	337	September 8, 2023

List all Rules Exceptions

Related topics