Managing event filters outside the UI

Elastic Security SIEM
1

Hi all,
I'm looking for a way to manage event filters across a number of deployments. Is there any API available to create / manage those or can it only be done in the UI?

The feature I'm referring to:

2

@ryanturner03 yes, you can use the API directly to manage Event Filters.

Refer to this documentation: Event filters | Elastic Security Solution [8.3] | Elastic

3

Nice! I knew it had to be somewhere - I didn't think of it as an endpoint API but makes sense now. Thanks Kevin!

4

One thing to add that I found is that the documentation mentions using a list_id of "endpoint_events", but in the version of Kibana I am using (8.3.2) the list_id that is used is "endpoint_event_filters".

If you don't use that list_id, the filters don't have any effect and wont appear in the UI

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.