starts lists api

Author: Ben Skelker

docs/siem/detections/api/lists/lists-api-create-list.asciidoc

@@ -0,0 +1,71 @@
+[[lists-api-create-list]]
+=== Create list container
+
+Creates a list container.
+
+A list container groups common list items that define exceptions for when
+alerts are not generated from their associated detection rule, even when the
+rule's query is matched. All list items in the same list container refer to the same type of exceptions. For example, each list item in an `ip` list container excludes a specific IP address. 
+
+
+==== Request URL
+
+`POST <kibana host>:<port>/api/lists`
+
+==== Request body
+
+A JSON object with these fields:
+
+[width="100%",options="header"]
+|==============================================
+|Name |Type |Description |Required
+
+|`description` |String |Describes the list container |Yes
+|`id` |String |Unique identifier |No, automatically created when it is not
+provided
+|`meta` |Object |Placeholder for metadata about the list container |No
+|`name` |String |The list container's name |Yes
+|`type` |String a|Specifies the datatype of excludes the list container holds:
+
+* `ip`: IP addresses
+* `keyword`: Any relevant {es} keyword 
+
+|Yes
+
+|==============================================
+
+===== Example request
+
+[source,console]
+--------------------------------------------------
+POST api/lists
+{
+  "id": "internal-ip-excludes",
+  "name": "Exclude internal IP addresses",
+  "description": "Contains list items that exclude internal IP addresses from detection rule matches.",
+  "type": "ip"
+}
+--------------------------------------------------
+// KIBANA
+
+==== Response code
+
+`200`:: 
+    Indicates a successful call.
+    
+==== Response payload
+
+[source,json]
+--------------------------------------------------
+{
+  "id": "internal-ip-excludes",
+  "created_at": "2020-06-24T13:25:20.027Z",
+  "created_by": "Threat Hunter",
+  "description": "Contains list items that exclude internal IP addresses from detection rule matches.",
+  "name": "Exclude internal IP addresses",
+  "tie_breaker_id": "39851ee3-038a-49d3-a7b8-85caeb098675",
+  "type": "ip",
+  "updated_at": "2020-06-24T13:25:20.027Z",
+  "updated_by": "Threat Hunter"
+}
+--------------------------------------------------