Add security exception item

CODING_STANDARDS.md

@@ -36,6 +36,7 @@ This document outlines the coding standards and conventions used in the terrafor
 - Prefer using existing util functions over longer form, duplicated code:
   - `utils.IsKnown(val)` instead of `!val.IsNull() && !val.IsUnknown()`
   - `utils.ListTypeAs` instead of `val.ElementsAs` or similar for other collection types
+  - `typeutils.StringishValue` instead of casting to a string eg `types.StringValue(string(apiResp.Id))`. Use `typeutils.StringishPointerValue` for pointers
 - The final state for a resource should be derived from a read request following a mutative request (eg create or update). We should not use the response from a mutative request to build the final resource state.
 
 ## Schema Definitions
@@ -75,6 +76,12 @@ This document outlines the coding standards and conventions used in the terrafor
   - Define any required variables within the module
   - Reference the test code via `ConfigDirectory: acctest.NamedTestCaseDirectory("<step description>")`
   - Define any required variables via `ConfigVariables`
+- Resources should include tests for the following
+  - Creating a resource
+  - Updating a resource
+  - Deleting a resource
+  - Importing a resource
+  - Creating a resoure in another space (if applicable)
 
 ## API Client Usage
 

examples/resources/elasticstack_kibana_security_exception_item/resource.tf

@@ -0,0 +1,36 @@
+resource "elasticstack_kibana_security_exception_list" "example" {
+  list_id        = "my-exception-list"
+  name           = "My Exception List"
+  description    = "List of exceptions"
+  type           = "detection"
+  namespace_type = "single"
+}
+
+resource "elasticstack_kibana_security_exception_item" "complex_entry" {
+  list_id        = elasticstack_kibana_security_exception_list.example.list_id
+  item_id        = "complex-exception"
+  name           = "Complex Exception with Multiple Entries"
+  description    = "Exception with multiple conditions"
+  type           = "simple"
+  namespace_type = "single"
+
+  # Multiple entries with different operators
+  entries = [
+    {
+      type     = "match"
+      field    = "host.name"
+      operator = "included"
+      value    = "trusted-host"
+    },
+    {
+      type     = "match_any"
+      field    = "user.name"
+      operator = "excluded"
+      values   = ["admin", "root"]
+    }
+  ]
+
+  os_types = ["linux"]
+  tags     = ["complex", "multi-condition"]
+}
+

generated/kbapi/transform_schema.go

@@ -870,6 +870,7 @@ func transformKibanaPaths(schema *Schema) {
 		},
 		"propertyName": "action_type_id",
 	})
+	schema.Components.Delete("schemas.Security_Exceptions_API_ExceptionListItemExpireTime.format")
 
 }
 

internal/clients/api_client.go

@@ -451,7 +451,9 @@ func (a *ApiClient) flavorFromKibana() (string, diag.Diagnostics) {
 
 	serverFlavor, ok := vMap["build_flavor"].(string)
 	if !ok {
-		return "", diag.Errorf("failed to get build flavor from Kibana status")
+		// build_flavor field is not present in older Kibana versions (pre-serverless)
+		// Default to empty string to indicate traditional/stateful deployment
+		return "", nil
 	}
 
 	return serverFlavor, nil