1. Packages
  2. Elasticstack Provider
  3. API Docs
  4. KibanaSecurityExceptionItem
elasticstack 0.13.1 published on Thursday, Dec 11, 2025 by elastic
Schema (JSON)
elastic/terraform-provider-elasticstack

elasticstack.KibanaSecurityExceptionItem

elasticstack logo
elasticstack 0.13.1 published on Thursday, Dec 11, 2025 by elastic
Schema (JSON)
elastic/terraform-provider-elasticstack

    Manages a Kibana Exception Item. Exception items define the specific query conditions used to prevent rules from generating alerts.

    See the Kibana Exceptions API documentation for more details.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as elasticstack from "@pulumi/elasticstack";

const example = new elasticstack.KibanaSecurityExceptionList("example", {
    listId: "my-exception-list",
    name: "My Exception List",
    description: "List of exceptions",
    type: "detection",
    namespaceType: "single",
});
const complexEntry = new elasticstack.KibanaSecurityExceptionItem("complex_entry", {
    listId: example.listId,
    itemId: "complex-exception",
    name: "Complex Exception with Multiple Entries",
    description: "Exception with multiple conditions",
    type: "simple",
    namespaceType: "single",
    entries: [
        {
            type: "match",
            field: "host.name",
            operator: "included",
            value: "trusted-host",
        },
        {
            type: "match_any",
            field: "user.name",
            operator: "excluded",
            values: [
                "admin",
                "root",
            ],
        },
    ],
    osTypes: ["linux"],
    tags: [
        "complex",
        "multi-condition",
    ],
});

    import pulumi
import pulumi_elasticstack as elasticstack

example = elasticstack.KibanaSecurityExceptionList("example",
    list_id="my-exception-list",
    name="My Exception List",
    description="List of exceptions",
    type="detection",
    namespace_type="single")
complex_entry = elasticstack.KibanaSecurityExceptionItem("complex_entry",
    list_id=example.list_id,
    item_id="complex-exception",
    name="Complex Exception with Multiple Entries",
    description="Exception with multiple conditions",
    type="simple",
    namespace_type="single",
    entries=[
        {
            "type": "match",
            "field": "host.name",
            "operator": "included",
            "value": "trusted-host",
        },
        {
            "type": "match_any",
            "field": "user.name",
            "operator": "excluded",
            "values": [
                "admin",
                "root",
            ],
        },
    ],
    os_types=["linux"],
    tags=[
        "complex",
        "multi-condition",
    ])

    package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/elasticstack/elasticstack"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := elasticstack.NewKibanaSecurityExceptionList(ctx, "example", &elasticstack.KibanaSecurityExceptionListArgs{
			ListId:        pulumi.String("my-exception-list"),
			Name:          pulumi.String("My Exception List"),
			Description:   pulumi.String("List of exceptions"),
			Type:          pulumi.String("detection"),
			NamespaceType: pulumi.String("single"),
		})
		if err != nil {
			return err
		}
		_, err = elasticstack.NewKibanaSecurityExceptionItem(ctx, "complex_entry", &elasticstack.KibanaSecurityExceptionItemArgs{
			ListId:        example.ListId,
			ItemId:        pulumi.String("complex-exception"),
			Name:          pulumi.String("Complex Exception with Multiple Entries"),
			Description:   pulumi.String("Exception with multiple conditions"),
			Type:          pulumi.String("simple"),
			NamespaceType: pulumi.String("single"),
			Entries: elasticstack.KibanaSecurityExceptionItemEntryArray{
				&elasticstack.KibanaSecurityExceptionItemEntryArgs{
					Type:     pulumi.String("match"),
					Field:    pulumi.String("host.name"),
					Operator: pulumi.String("included"),
					Value:    pulumi.String("trusted-host"),
				},
				&elasticstack.KibanaSecurityExceptionItemEntryArgs{
					Type:     pulumi.String("match_any"),
					Field:    pulumi.String("user.name"),
					Operator: pulumi.String("excluded"),
					Values: pulumi.StringArray{
						pulumi.String("admin"),
						pulumi.String("root"),
					},
				},
			},
			OsTypes: pulumi.StringArray{
				pulumi.String("linux"),
			},
			Tags: pulumi.StringArray{
				pulumi.String("complex"),
				pulumi.String("multi-condition"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Elasticstack = Pulumi.Elasticstack;

return await Deployment.RunAsync(() => 
{
    var example = new Elasticstack.KibanaSecurityExceptionList("example", new()
    {
        ListId = "my-exception-list",
        Name = "My Exception List",
        Description = "List of exceptions",
        Type = "detection",
        NamespaceType = "single",
    });

    var complexEntry = new Elasticstack.KibanaSecurityExceptionItem("complex_entry", new()
    {
        ListId = example.ListId,
        ItemId = "complex-exception",
        Name = "Complex Exception with Multiple Entries",
        Description = "Exception with multiple conditions",
        Type = "simple",
        NamespaceType = "single",
        Entries = new[]
        {
            new Elasticstack.Inputs.KibanaSecurityExceptionItemEntryArgs
            {
                Type = "match",
                Field = "host.name",
                Operator = "included",
                Value = "trusted-host",
            },
            new Elasticstack.Inputs.KibanaSecurityExceptionItemEntryArgs
            {
                Type = "match_any",
                Field = "user.name",
                Operator = "excluded",
                Values = new[]
                {
                    "admin",
                    "root",
                },
            },
        },
        OsTypes = new[]
        {
            "linux",
        },
        Tags = new[]
        {
            "complex",
            "multi-condition",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.elasticstack.KibanaSecurityExceptionList;
import com.pulumi.elasticstack.KibanaSecurityExceptionListArgs;
import com.pulumi.elasticstack.KibanaSecurityExceptionItem;
import com.pulumi.elasticstack.KibanaSecurityExceptionItemArgs;
import com.pulumi.elasticstack.inputs.KibanaSecurityExceptionItemEntryArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new KibanaSecurityExceptionList("example", KibanaSecurityExceptionListArgs.builder()
            .listId("my-exception-list")
            .name("My Exception List")
            .description("List of exceptions")
            .type("detection")
            .namespaceType("single")
            .build());

        var complexEntry = new KibanaSecurityExceptionItem("complexEntry", KibanaSecurityExceptionItemArgs.builder()
            .listId(example.listId())
            .itemId("complex-exception")
            .name("Complex Exception with Multiple Entries")
            .description("Exception with multiple conditions")
            .type("simple")
            .namespaceType("single")
            .entries(            
                KibanaSecurityExceptionItemEntryArgs.builder()
                    .type("match")
                    .field("host.name")
                    .operator("included")
                    .value("trusted-host")
                    .build(),
                KibanaSecurityExceptionItemEntryArgs.builder()
                    .type("match_any")
                    .field("user.name")
                    .operator("excluded")
                    .values(                    
                        "admin",
                        "root")
                    .build())
            .osTypes("linux")
            .tags(            
                "complex",
                "multi-condition")
            .build());

    }
}

    resources:
  example:
    type: elasticstack:KibanaSecurityExceptionList
    properties:
      listId: my-exception-list
      name: My Exception List
      description: List of exceptions
      type: detection
      namespaceType: single
  complexEntry:
    type: elasticstack:KibanaSecurityExceptionItem
    name: complex_entry
    properties:
      listId: ${example.listId}
      itemId: complex-exception
      name: Complex Exception with Multiple Entries
      description: Exception with multiple conditions
      type: simple
      namespaceType: single
      entries:
        - type: match
          field: host.name
          operator: included
          value: trusted-host
        - type: match_any
          field: user.name
          operator: excluded
          values:
            - admin
            - root
      osTypes:
        - linux
      tags:
        - complex
        - multi-condition

    Create KibanaSecurityExceptionItem Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new KibanaSecurityExceptionItem(name: string, args: KibanaSecurityExceptionItemArgs, opts?: CustomResourceOptions);
    @overload
def KibanaSecurityExceptionItem(resource_name: str,
                                args: KibanaSecurityExceptionItemArgs,
                                opts: Optional[ResourceOptions] = None)

@overload
def KibanaSecurityExceptionItem(resource_name: str,
                                opts: Optional[ResourceOptions] = None,
                                list_id: Optional[str] = None,
                                description: Optional[str] = None,
                                entries: Optional[Sequence[KibanaSecurityExceptionItemEntryArgs]] = None,
                                type: Optional[str] = None,
                                meta: Optional[str] = None,
                                item_id: Optional[str] = None,
                                comments: Optional[Sequence[KibanaSecurityExceptionItemCommentArgs]] = None,
                                name: Optional[str] = None,
                                namespace_type: Optional[str] = None,
                                os_types: Optional[Sequence[str]] = None,
                                space_id: Optional[str] = None,
                                tags: Optional[Sequence[str]] = None,
                                expire_time: Optional[str] = None)
    func NewKibanaSecurityExceptionItem(ctx *Context, name string, args KibanaSecurityExceptionItemArgs, opts ...ResourceOption) (*KibanaSecurityExceptionItem, error)
    public KibanaSecurityExceptionItem(string name, KibanaSecurityExceptionItemArgs args, CustomResourceOptions? opts = null)
    public KibanaSecurityExceptionItem(String name, KibanaSecurityExceptionItemArgs args)
public KibanaSecurityExceptionItem(String name, KibanaSecurityExceptionItemArgs args, CustomResourceOptions options)

    type: elasticstack:KibanaSecurityExceptionItem
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args KibanaSecurityExceptionItemArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args KibanaSecurityExceptionItemArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args KibanaSecurityExceptionItemArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args KibanaSecurityExceptionItemArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args KibanaSecurityExceptionItemArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var kibanaSecurityExceptionItemResource = new Elasticstack.KibanaSecurityExceptionItem("kibanaSecurityExceptionItemResource", new()
{
    ListId = "string",
    Description = "string",
    Entries = new[]
    {
        new Elasticstack.Inputs.KibanaSecurityExceptionItemEntryArgs
        {
            Field = "string",
            Type = "string",
            Entries = new[]
            {
                new Elasticstack.Inputs.KibanaSecurityExceptionItemEntryEntryArgs
                {
                    Field = "string",
                    Operator = "string",
                    Type = "string",
                    Value = "string",
                    Values = new[]
                    {
                        "string",
                    },
                },
            },
            List = new Elasticstack.Inputs.KibanaSecurityExceptionItemEntryListArgs
            {
                Id = "string",
                Type = "string",
            },
            Operator = "string",
            Value = "string",
            Values = new[]
            {
                "string",
            },
        },
    },
    Type = "string",
    Meta = "string",
    ItemId = "string",
    Comments = new[]
    {
        new Elasticstack.Inputs.KibanaSecurityExceptionItemCommentArgs
        {
            Comment = "string",
            Id = "string",
        },
    },
    Name = "string",
    NamespaceType = "string",
    OsTypes = new[]
    {
        "string",
    },
    SpaceId = "string",
    Tags = new[]
    {
        "string",
    },
    ExpireTime = "string",
});

    example, err := elasticstack.NewKibanaSecurityExceptionItem(ctx, "kibanaSecurityExceptionItemResource", &elasticstack.KibanaSecurityExceptionItemArgs{
	ListId:      pulumi.String("string"),
	Description: pulumi.String("string"),
	Entries: elasticstack.KibanaSecurityExceptionItemEntryArray{
		&elasticstack.KibanaSecurityExceptionItemEntryArgs{
			Field: pulumi.String("string"),
			Type:  pulumi.String("string"),
			Entries: elasticstack.KibanaSecurityExceptionItemEntryEntryArray{
				&elasticstack.KibanaSecurityExceptionItemEntryEntryArgs{
					Field:    pulumi.String("string"),
					Operator: pulumi.String("string"),
					Type:     pulumi.String("string"),
					Value:    pulumi.String("string"),
					Values: pulumi.StringArray{
						pulumi.String("string"),
					},
				},
			},
			List: &elasticstack.KibanaSecurityExceptionItemEntryListArgs{
				Id:   pulumi.String("string"),
				Type: pulumi.String("string"),
			},
			Operator: pulumi.String("string"),
			Value:    pulumi.String("string"),
			Values: pulumi.StringArray{
				pulumi.String("string"),
			},
		},
	},
	Type:   pulumi.String("string"),
	Meta:   pulumi.String("string"),
	ItemId: pulumi.String("string"),
	Comments: elasticstack.KibanaSecurityExceptionItemCommentArray{
		&elasticstack.KibanaSecurityExceptionItemCommentArgs{
			Comment: pulumi.String("string"),
			Id:      pulumi.String("string"),
		},
	},
	Name:          pulumi.String("string"),
	NamespaceType: pulumi.String("string"),
	OsTypes: pulumi.StringArray{
		pulumi.String("string"),
	},
	SpaceId: pulumi.String("string"),
	Tags: pulumi.StringArray{
		pulumi.String("string"),
	},
	ExpireTime: pulumi.String("string"),
})

    var kibanaSecurityExceptionItemResource = new KibanaSecurityExceptionItem("kibanaSecurityExceptionItemResource", KibanaSecurityExceptionItemArgs.builder()
    .listId("string")
    .description("string")
    .entries(KibanaSecurityExceptionItemEntryArgs.builder()
        .field("string")
        .type("string")
        .entries(KibanaSecurityExceptionItemEntryEntryArgs.builder()
            .field("string")
            .operator("string")
            .type("string")
            .value("string")
            .values("string")
            .build())
        .list(KibanaSecurityExceptionItemEntryListArgs.builder()
            .id("string")
            .type("string")
            .build())
        .operator("string")
        .value("string")
        .values("string")
        .build())
    .type("string")
    .meta("string")
    .itemId("string")
    .comments(KibanaSecurityExceptionItemCommentArgs.builder()
        .comment("string")
        .id("string")
        .build())
    .name("string")
    .namespaceType("string")
    .osTypes("string")
    .spaceId("string")
    .tags("string")
    .expireTime("string")
    .build());

    kibana_security_exception_item_resource = elasticstack.KibanaSecurityExceptionItem("kibanaSecurityExceptionItemResource",
    list_id="string",
    description="string",
    entries=[{
        "field": "string",
        "type": "string",
        "entries": [{
            "field": "string",
            "operator": "string",
            "type": "string",
            "value": "string",
            "values": ["string"],
        }],
        "list": {
            "id": "string",
            "type": "string",
        },
        "operator": "string",
        "value": "string",
        "values": ["string"],
    }],
    type="string",
    meta="string",
    item_id="string",
    comments=[{
        "comment": "string",
        "id": "string",
    }],
    name="string",
    namespace_type="string",
    os_types=["string"],
    space_id="string",
    tags=["string"],
    expire_time="string")

    const kibanaSecurityExceptionItemResource = new elasticstack.KibanaSecurityExceptionItem("kibanaSecurityExceptionItemResource", {
    listId: "string",
    description: "string",
    entries: [{
        field: "string",
        type: "string",
        entries: [{
            field: "string",
            operator: "string",
            type: "string",
            value: "string",
            values: ["string"],
        }],
        list: {
            id: "string",
            type: "string",
        },
        operator: "string",
        value: "string",
        values: ["string"],
    }],
    type: "string",
    meta: "string",
    itemId: "string",
    comments: [{
        comment: "string",
        id: "string",
    }],
    name: "string",
    namespaceType: "string",
    osTypes: ["string"],
    spaceId: "string",
    tags: ["string"],
    expireTime: "string",
});

    type: elasticstack:KibanaSecurityExceptionItem
properties:
    comments:
        - comment: string
          id: string
    description: string
    entries:
        - entries:
            - field: string
              operator: string
              type: string
              value: string
              values:
                - string
          field: string
          list:
            id: string
            type: string
          operator: string
          type: string
          value: string
          values:
            - string
    expireTime: string
    itemId: string
    listId: string
    meta: string
    name: string
    namespaceType: string
    osTypes:
        - string
    spaceId: string
    tags:
        - string
    type: string

    KibanaSecurityExceptionItem Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The KibanaSecurityExceptionItem resource accepts the following input properties:

    Description string
    Describes the exception item.
    Entries List<KibanaSecurityExceptionItemEntry>
    The exception item entries. This defines the conditions under which the exception applies.
    ListId string
    The exception list's identifier that this item belongs to.
    Type string
    The type of exception item. Must be simple.
    Comments List<KibanaSecurityExceptionItemComment>
    Array of comments about the exception item.
    ExpireTime string
    The exception item's expiration date in RFC3339 format. This field is only available for regular exception items, not endpoint exceptions.
    ItemId string
    The exception item's human readable string identifier.
    Meta string
    Placeholder for metadata about the exception item as JSON string.
    Name string
    The name of the exception item.
    NamespaceType string
    Determines whether the exception item is available in all Kibana spaces or just the space in which it is created. Can be single (default) or agnostic.
    OsTypes List<string>
    Array of OS types for which the exceptions apply. Valid values: linux, macos, windows.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Tags List<string>
    String array containing words and phrases to help categorize exception items.
    Description string
    Describes the exception item.
    Entries []KibanaSecurityExceptionItemEntryArgs
    The exception item entries. This defines the conditions under which the exception applies.
    ListId string
    The exception list's identifier that this item belongs to.
    Type string
    The type of exception item. Must be simple.
    Comments []KibanaSecurityExceptionItemCommentArgs
    Array of comments about the exception item.
    ExpireTime string
    The exception item's expiration date in RFC3339 format. This field is only available for regular exception items, not endpoint exceptions.
    ItemId string
    The exception item's human readable string identifier.
    Meta string
    Placeholder for metadata about the exception item as JSON string.
    Name string
    The name of the exception item.
    NamespaceType string
    Determines whether the exception item is available in all Kibana spaces or just the space in which it is created. Can be single (default) or agnostic.
    OsTypes []string
    Array of OS types for which the exceptions apply. Valid values: linux, macos, windows.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Tags []string
    String array containing words and phrases to help categorize exception items.
    description String
    Describes the exception item.
    entries List<KibanaSecurityExceptionItemEntry>
    The exception item entries. This defines the conditions under which the exception applies.
    listId String
    The exception list's identifier that this item belongs to.
    type String
    The type of exception item. Must be simple.
    comments List<KibanaSecurityExceptionItemComment>
    Array of comments about the exception item.
    expireTime String
    The exception item's expiration date in RFC3339 format. This field is only available for regular exception items, not endpoint exceptions.
    itemId String
    The exception item's human readable string identifier.
    meta String
    Placeholder for metadata about the exception item as JSON string.
    name String
    The name of the exception item.
    namespaceType String
    Determines whether the exception item is available in all Kibana spaces or just the space in which it is created. Can be single (default) or agnostic.
    osTypes List<String>
    Array of OS types for which the exceptions apply. Valid values: linux, macos, windows.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    tags List<String>
    String array containing words and phrases to help categorize exception items.
    description string
    Describes the exception item.
    entries KibanaSecurityExceptionItemEntry[]
    The exception item entries. This defines the conditions under which the exception applies.
    listId string
    The exception list's identifier that this item belongs to.
    type string
    The type of exception item. Must be simple.
    comments KibanaSecurityExceptionItemComment[]
    Array of comments about the exception item.
    expireTime string
    The exception item's expiration date in RFC3339 format. This field is only available for regular exception items, not endpoint exceptions.
    itemId string
    The exception item's human readable string identifier.
    meta string
    Placeholder for metadata about the exception item as JSON string.
    name string
    The name of the exception item.
    namespaceType string
    Determines whether the exception item is available in all Kibana spaces or just the space in which it is created. Can be single (default) or agnostic.
    osTypes string[]
    Array of OS types for which the exceptions apply. Valid values: linux, macos, windows.
    spaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    tags string[]
    String array containing words and phrases to help categorize exception items.
    description str
    Describes the exception item.
    entries Sequence[KibanaSecurityExceptionItemEntryArgs]
    The exception item entries. This defines the conditions under which the exception applies.
    list_id str
    The exception list's identifier that this item belongs to.
    type str
    The type of exception item. Must be simple.
    comments Sequence[KibanaSecurityExceptionItemCommentArgs]
    Array of comments about the exception item.
    expire_time str
    The exception item's expiration date in RFC3339 format. This field is only available for regular exception items, not endpoint exceptions.
    item_id str
    The exception item's human readable string identifier.
    meta str
    Placeholder for metadata about the exception item as JSON string.
    name str
    The name of the exception item.
    namespace_type str
    Determines whether the exception item is available in all Kibana spaces or just the space in which it is created. Can be single (default) or agnostic.
    os_types Sequence[str]
    Array of OS types for which the exceptions apply. Valid values: linux, macos, windows.
    space_id str
    An identifier for the space. If space_id is not provided, the default space is used.
    tags Sequence[str]
    String array containing words and phrases to help categorize exception items.
    description String
    Describes the exception item.
    entries List<Property Map>
    The exception item entries. This defines the conditions under which the exception applies.
    listId String
    The exception list's identifier that this item belongs to.
    type String
    The type of exception item. Must be simple.
    comments List<Property Map>
    Array of comments about the exception item.
    expireTime String
    The exception item's expiration date in RFC3339 format. This field is only available for regular exception items, not endpoint exceptions.
    itemId String
    The exception item's human readable string identifier.
    meta String
    Placeholder for metadata about the exception item as JSON string.
    name String
    The name of the exception item.
    namespaceType String
    Determines whether the exception item is available in all Kibana spaces or just the space in which it is created. Can be single (default) or agnostic.
    osTypes List<String>
    Array of OS types for which the exceptions apply. Valid values: linux, macos, windows.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    tags List<String>
    String array containing words and phrases to help categorize exception items.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the KibanaSecurityExceptionItem resource produces the following output properties:

    CreatedAt string
    The timestamp of when the exception item was created.
    CreatedBy string
    The user who created the exception item.
    Id string
    The provider-assigned unique ID for this managed resource.
    TieBreakerId string
    Field used in search to ensure all items are sorted and returned correctly.
    UpdatedAt string
    The timestamp of when the exception item was last updated.
    UpdatedBy string
    The user who last updated the exception item.
    CreatedAt string
    The timestamp of when the exception item was created.
    CreatedBy string
    The user who created the exception item.
    Id string
    The provider-assigned unique ID for this managed resource.
    TieBreakerId string
    Field used in search to ensure all items are sorted and returned correctly.
    UpdatedAt string
    The timestamp of when the exception item was last updated.
    UpdatedBy string
    The user who last updated the exception item.
    createdAt String
    The timestamp of when the exception item was created.
    createdBy String
    The user who created the exception item.
    id String
    The provider-assigned unique ID for this managed resource.
    tieBreakerId String
    Field used in search to ensure all items are sorted and returned correctly.
    updatedAt String
    The timestamp of when the exception item was last updated.
    updatedBy String
    The user who last updated the exception item.
    createdAt string
    The timestamp of when the exception item was created.
    createdBy string
    The user who created the exception item.
    id string
    The provider-assigned unique ID for this managed resource.
    tieBreakerId string
    Field used in search to ensure all items are sorted and returned correctly.
    updatedAt string
    The timestamp of when the exception item was last updated.
    updatedBy string
    The user who last updated the exception item.
    created_at str
    The timestamp of when the exception item was created.
    created_by str
    The user who created the exception item.
    id str
    The provider-assigned unique ID for this managed resource.
    tie_breaker_id str
    Field used in search to ensure all items are sorted and returned correctly.
    updated_at str
    The timestamp of when the exception item was last updated.
    updated_by str
    The user who last updated the exception item.
    createdAt String
    The timestamp of when the exception item was created.
    createdBy String
    The user who created the exception item.
    id String
    The provider-assigned unique ID for this managed resource.
    tieBreakerId String
    Field used in search to ensure all items are sorted and returned correctly.
    updatedAt String
    The timestamp of when the exception item was last updated.
    updatedBy String
    The user who last updated the exception item.

    Look up Existing KibanaSecurityExceptionItem Resource

    Get an existing KibanaSecurityExceptionItem resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: KibanaSecurityExceptionItemState, opts?: CustomResourceOptions): KibanaSecurityExceptionItem
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        comments: Optional[Sequence[KibanaSecurityExceptionItemCommentArgs]] = None,
        created_at: Optional[str] = None,
        created_by: Optional[str] = None,
        description: Optional[str] = None,
        entries: Optional[Sequence[KibanaSecurityExceptionItemEntryArgs]] = None,
        expire_time: Optional[str] = None,
        item_id: Optional[str] = None,
        list_id: Optional[str] = None,
        meta: Optional[str] = None,
        name: Optional[str] = None,
        namespace_type: Optional[str] = None,
        os_types: Optional[Sequence[str]] = None,
        space_id: Optional[str] = None,
        tags: Optional[Sequence[str]] = None,
        tie_breaker_id: Optional[str] = None,
        type: Optional[str] = None,
        updated_at: Optional[str] = None,
        updated_by: Optional[str] = None) -> KibanaSecurityExceptionItem
    func GetKibanaSecurityExceptionItem(ctx *Context, name string, id IDInput, state *KibanaSecurityExceptionItemState, opts ...ResourceOption) (*KibanaSecurityExceptionItem, error)
    public static KibanaSecurityExceptionItem Get(string name, Input<string> id, KibanaSecurityExceptionItemState? state, CustomResourceOptions? opts = null)
    public static KibanaSecurityExceptionItem get(String name, Output<String> id, KibanaSecurityExceptionItemState state, CustomResourceOptions options)
    resources:  _:    type: elasticstack:KibanaSecurityExceptionItem    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Comments List<KibanaSecurityExceptionItemComment>
    Array of comments about the exception item.
    CreatedAt string
    The timestamp of when the exception item was created.
    CreatedBy string
    The user who created the exception item.
    Description string
    Describes the exception item.
    Entries List<KibanaSecurityExceptionItemEntry>
    The exception item entries. This defines the conditions under which the exception applies.
    ExpireTime string
    The exception item's expiration date in RFC3339 format. This field is only available for regular exception items, not endpoint exceptions.
    ItemId string
    The exception item's human readable string identifier.
    ListId string
    The exception list's identifier that this item belongs to.
    Meta string
    Placeholder for metadata about the exception item as JSON string.
    Name string
    The name of the exception item.
    NamespaceType string
    Determines whether the exception item is available in all Kibana spaces or just the space in which it is created. Can be single (default) or agnostic.
    OsTypes List<string>
    Array of OS types for which the exceptions apply. Valid values: linux, macos, windows.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Tags List<string>
    String array containing words and phrases to help categorize exception items.
    TieBreakerId string
    Field used in search to ensure all items are sorted and returned correctly.
    Type string
    The type of exception item. Must be simple.
    UpdatedAt string
    The timestamp of when the exception item was last updated.
    UpdatedBy string
    The user who last updated the exception item.
    Comments []KibanaSecurityExceptionItemCommentArgs
    Array of comments about the exception item.
    CreatedAt string
    The timestamp of when the exception item was created.
    CreatedBy string
    The user who created the exception item.
    Description string
    Describes the exception item.
    Entries []KibanaSecurityExceptionItemEntryArgs
    The exception item entries. This defines the conditions under which the exception applies.
    ExpireTime string
    The exception item's expiration date in RFC3339 format. This field is only available for regular exception items, not endpoint exceptions.
    ItemId string
    The exception item's human readable string identifier.
    ListId string
    The exception list's identifier that this item belongs to.
    Meta string
    Placeholder for metadata about the exception item as JSON string.
    Name string
    The name of the exception item.
    NamespaceType string
    Determines whether the exception item is available in all Kibana spaces or just the space in which it is created. Can be single (default) or agnostic.
    OsTypes []string
    Array of OS types for which the exceptions apply. Valid values: linux, macos, windows.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Tags []string
    String array containing words and phrases to help categorize exception items.
    TieBreakerId string
    Field used in search to ensure all items are sorted and returned correctly.
    Type string
    The type of exception item. Must be simple.
    UpdatedAt string
    The timestamp of when the exception item was last updated.
    UpdatedBy string
    The user who last updated the exception item.
    comments List<KibanaSecurityExceptionItemComment>
    Array of comments about the exception item.
    createdAt String
    The timestamp of when the exception item was created.
    createdBy String
    The user who created the exception item.
    description String
    Describes the exception item.
    entries List<KibanaSecurityExceptionItemEntry>
    The exception item entries. This defines the conditions under which the exception applies.
    expireTime String
    The exception item's expiration date in RFC3339 format. This field is only available for regular exception items, not endpoint exceptions.
    itemId String
    The exception item's human readable string identifier.
    listId String
    The exception list's identifier that this item belongs to.
    meta String
    Placeholder for metadata about the exception item as JSON string.
    name String
    The name of the exception item.
    namespaceType String
    Determines whether the exception item is available in all Kibana spaces or just the space in which it is created. Can be single (default) or agnostic.
    osTypes List<String>
    Array of OS types for which the exceptions apply. Valid values: linux, macos, windows.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    tags List<String>
    String array containing words and phrases to help categorize exception items.
    tieBreakerId String
    Field used in search to ensure all items are sorted and returned correctly.
    type String
    The type of exception item. Must be simple.
    updatedAt String
    The timestamp of when the exception item was last updated.
    updatedBy String
    The user who last updated the exception item.
    comments KibanaSecurityExceptionItemComment[]
    Array of comments about the exception item.
    createdAt string
    The timestamp of when the exception item was created.
    createdBy string
    The user who created the exception item.
    description string
    Describes the exception item.
    entries KibanaSecurityExceptionItemEntry[]
    The exception item entries. This defines the conditions under which the exception applies.
    expireTime string
    The exception item's expiration date in RFC3339 format. This field is only available for regular exception items, not endpoint exceptions.
    itemId string
    The exception item's human readable string identifier.
    listId string
    The exception list's identifier that this item belongs to.
    meta string
    Placeholder for metadata about the exception item as JSON string.
    name string
    The name of the exception item.
    namespaceType string
    Determines whether the exception item is available in all Kibana spaces or just the space in which it is created. Can be single (default) or agnostic.
    osTypes string[]
    Array of OS types for which the exceptions apply. Valid values: linux, macos, windows.
    spaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    tags string[]
    String array containing words and phrases to help categorize exception items.
    tieBreakerId string
    Field used in search to ensure all items are sorted and returned correctly.
    type string
    The type of exception item. Must be simple.
    updatedAt string
    The timestamp of when the exception item was last updated.
    updatedBy string
    The user who last updated the exception item.
    comments Sequence[KibanaSecurityExceptionItemCommentArgs]
    Array of comments about the exception item.
    created_at str
    The timestamp of when the exception item was created.
    created_by str
    The user who created the exception item.
    description str
    Describes the exception item.
    entries Sequence[KibanaSecurityExceptionItemEntryArgs]
    The exception item entries. This defines the conditions under which the exception applies.
    expire_time str
    The exception item's expiration date in RFC3339 format. This field is only available for regular exception items, not endpoint exceptions.
    item_id str
    The exception item's human readable string identifier.
    list_id str
    The exception list's identifier that this item belongs to.
    meta str
    Placeholder for metadata about the exception item as JSON string.
    name str
    The name of the exception item.
    namespace_type str
    Determines whether the exception item is available in all Kibana spaces or just the space in which it is created. Can be single (default) or agnostic.
    os_types Sequence[str]
    Array of OS types for which the exceptions apply. Valid values: linux, macos, windows.
    space_id str
    An identifier for the space. If space_id is not provided, the default space is used.
    tags Sequence[str]
    String array containing words and phrases to help categorize exception items.
    tie_breaker_id str
    Field used in search to ensure all items are sorted and returned correctly.
    type str
    The type of exception item. Must be simple.
    updated_at str
    The timestamp of when the exception item was last updated.
    updated_by str
    The user who last updated the exception item.
    comments List<Property Map>
    Array of comments about the exception item.
    createdAt String
    The timestamp of when the exception item was created.
    createdBy String
    The user who created the exception item.
    description String
    Describes the exception item.
    entries List<Property Map>
    The exception item entries. This defines the conditions under which the exception applies.
    expireTime String
    The exception item's expiration date in RFC3339 format. This field is only available for regular exception items, not endpoint exceptions.
    itemId String
    The exception item's human readable string identifier.
    listId String
    The exception list's identifier that this item belongs to.
    meta String
    Placeholder for metadata about the exception item as JSON string.
    name String
    The name of the exception item.
    namespaceType String
    Determines whether the exception item is available in all Kibana spaces or just the space in which it is created. Can be single (default) or agnostic.
    osTypes List<String>
    Array of OS types for which the exceptions apply. Valid values: linux, macos, windows.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    tags List<String>
    String array containing words and phrases to help categorize exception items.
    tieBreakerId String
    Field used in search to ensure all items are sorted and returned correctly.
    type String
    The type of exception item. Must be simple.
    updatedAt String
    The timestamp of when the exception item was last updated.
    updatedBy String
    The user who last updated the exception item.

    Supporting Types

    KibanaSecurityExceptionItemComment, KibanaSecurityExceptionItemCommentArgs

    Comment string
    The comment text.
    Id string
    The unique identifier of the comment (auto-generated by Kibana).
    Comment string
    The comment text.
    Id string
    The unique identifier of the comment (auto-generated by Kibana).
    comment String
    The comment text.
    id String
    The unique identifier of the comment (auto-generated by Kibana).
    comment string
    The comment text.
    id string
    The unique identifier of the comment (auto-generated by Kibana).
    comment str
    The comment text.
    id str
    The unique identifier of the comment (auto-generated by Kibana).
    comment String
    The comment text.
    id String
    The unique identifier of the comment (auto-generated by Kibana).

    KibanaSecurityExceptionItemEntry, KibanaSecurityExceptionItemEntryArgs

    Field string
    The field name. Required for all entry types.
    Type string
    The type of entry. Valid values: match, match_any, list, exists, nested, wildcard.
    Entries List<KibanaSecurityExceptionItemEntryEntry>
    Nested entries (for nested type). Only match, match_any, and exists entry types are allowed as nested entries.
    List KibanaSecurityExceptionItemEntryList
    Value list reference (for list type).
    Operator string
    The operator to use. Valid values: included, excluded. Note: The operator field is not supported for nested entry types and will be ignored if specified.
    Value string
    The value to match (for match and wildcard types).
    Values List<string>
    Array of values to match (for match_any type).
    Field string
    The field name. Required for all entry types.
    Type string
    The type of entry. Valid values: match, match_any, list, exists, nested, wildcard.
    Entries []KibanaSecurityExceptionItemEntryEntry
    Nested entries (for nested type). Only match, match_any, and exists entry types are allowed as nested entries.
    List KibanaSecurityExceptionItemEntryList
    Value list reference (for list type).
    Operator string
    The operator to use. Valid values: included, excluded. Note: The operator field is not supported for nested entry types and will be ignored if specified.
    Value string
    The value to match (for match and wildcard types).
    Values []string
    Array of values to match (for match_any type).
    field String
    The field name. Required for all entry types.
    type String
    The type of entry. Valid values: match, match_any, list, exists, nested, wildcard.
    entries List<KibanaSecurityExceptionItemEntryEntry>
    Nested entries (for nested type). Only match, match_any, and exists entry types are allowed as nested entries.
    list KibanaSecurityExceptionItemEntryList
    Value list reference (for list type).
    operator String
    The operator to use. Valid values: included, excluded. Note: The operator field is not supported for nested entry types and will be ignored if specified.
    value String
    The value to match (for match and wildcard types).
    values List<String>
    Array of values to match (for match_any type).
    field string
    The field name. Required for all entry types.
    type string
    The type of entry. Valid values: match, match_any, list, exists, nested, wildcard.
    entries KibanaSecurityExceptionItemEntryEntry[]
    Nested entries (for nested type). Only match, match_any, and exists entry types are allowed as nested entries.
    list KibanaSecurityExceptionItemEntryList
    Value list reference (for list type).
    operator string
    The operator to use. Valid values: included, excluded. Note: The operator field is not supported for nested entry types and will be ignored if specified.
    value string
    The value to match (for match and wildcard types).
    values string[]
    Array of values to match (for match_any type).
    field str
    The field name. Required for all entry types.
    type str
    The type of entry. Valid values: match, match_any, list, exists, nested, wildcard.
    entries Sequence[KibanaSecurityExceptionItemEntryEntry]
    Nested entries (for nested type). Only match, match_any, and exists entry types are allowed as nested entries.
    list KibanaSecurityExceptionItemEntryList
    Value list reference (for list type).
    operator str
    The operator to use. Valid values: included, excluded. Note: The operator field is not supported for nested entry types and will be ignored if specified.
    value str
    The value to match (for match and wildcard types).
    values Sequence[str]
    Array of values to match (for match_any type).
    field String
    The field name. Required for all entry types.
    type String
    The type of entry. Valid values: match, match_any, list, exists, nested, wildcard.
    entries List<Property Map>
    Nested entries (for nested type). Only match, match_any, and exists entry types are allowed as nested entries.
    list Property Map
    Value list reference (for list type).
    operator String
    The operator to use. Valid values: included, excluded. Note: The operator field is not supported for nested entry types and will be ignored if specified.
    value String
    The value to match (for match and wildcard types).
    values List<String>
    Array of values to match (for match_any type).

    KibanaSecurityExceptionItemEntryEntry, KibanaSecurityExceptionItemEntryEntryArgs

    Field string
    The field name.
    Operator string
    The operator to use. Valid values: included, excluded.
    Type string
    The type of nested entry. Valid values: match, match_any, exists.
    Value string
    The value to match (for match type).
    Values List<string>
    Array of values to match (for match_any type).
    Field string
    The field name.
    Operator string
    The operator to use. Valid values: included, excluded.
    Type string
    The type of nested entry. Valid values: match, match_any, exists.
    Value string
    The value to match (for match type).
    Values []string
    Array of values to match (for match_any type).
    field String
    The field name.
    operator String
    The operator to use. Valid values: included, excluded.
    type String
    The type of nested entry. Valid values: match, match_any, exists.
    value String
    The value to match (for match type).
    values List<String>
    Array of values to match (for match_any type).
    field string
    The field name.
    operator string
    The operator to use. Valid values: included, excluded.
    type string
    The type of nested entry. Valid values: match, match_any, exists.
    value string
    The value to match (for match type).
    values string[]
    Array of values to match (for match_any type).
    field str
    The field name.
    operator str
    The operator to use. Valid values: included, excluded.
    type str
    The type of nested entry. Valid values: match, match_any, exists.
    value str
    The value to match (for match type).
    values Sequence[str]
    Array of values to match (for match_any type).
    field String
    The field name.
    operator String
    The operator to use. Valid values: included, excluded.
    type String
    The type of nested entry. Valid values: match, match_any, exists.
    value String
    The value to match (for match type).
    values List<String>
    Array of values to match (for match_any type).

    KibanaSecurityExceptionItemEntryList, KibanaSecurityExceptionItemEntryListArgs

    Id string
    The value list ID.
    Type string
    The value list type (e.g., keyword, ip, ip_range).
    Id string
    The value list ID.
    Type string
    The value list type (e.g., keyword, ip, ip_range).
    id String
    The value list ID.
    type String
    The value list type (e.g., keyword, ip, ip_range).
    id string
    The value list ID.
    type string
    The value list type (e.g., keyword, ip, ip_range).
    id str
    The value list ID.
    type str
    The value list type (e.g., keyword, ip, ip_range).
    id String
    The value list ID.
    type String
    The value list type (e.g., keyword, ip, ip_range).

    Package Details

    Repository
    elasticstack elastic/terraform-provider-elasticstack
    License
    Notes
    This Pulumi package is based on the elasticstack Terraform Provider.
    elasticstack logo
    elasticstack 0.13.1 published on Thursday, Dec 11, 2025 by elastic
    Schema (JSON)
    elastic/terraform-provider-elasticstack
      Meet Neo: Your AI Platform Teammate