[Security Solution][Detections] Apply wildcards in value lists to exceptions

[andrew-goldstein]

Detection engine does not expand wildcards, for example *.googleapis.com in value lists when processing exceptions.

For example, a Keyword value list containing the following entry:

*.googleapis.com

when applied as an exception to a rule with the following query:

dns.question.name : *

will today, as of version 7.10, not prevent alerts from being generated for the example rule above, even if a sample event contained the following value for the dns.question.name field:

logging.googleapis.com

Kibana/Elasticsearch Stack version:

7.10

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Detection Rules

Steps to reproduce:

1. Upload a Keyword value list containing the following value:

*.googleapis.com

per the screenshot below:

2. Create a rule with the following query:

dns.question.name : *

as shown in the screenshot below:

3. Create an exception for the rule that uses the value list, per the screenshot below:

Current behavior:

Alerts are still generated for events where the value of the dns.question.name field, for example:

logging.googleapis.com

would be covered by the expanded wildcard in the exception:

*.googleapis.com

as shown in the screenshot below:

Expected behavior:

An alert is not generated, because the wildcard in the exception's value list expands to match the value of the field in the source document.

[andrew-goldstein]

A user is describing a scenario where they would apply wildcards in an exception list in this discuss post

[ayedem]

Any update on this? This is functionality that is desperately needed.

[rdrgporto]

Hi,

This feature would be very useful 👍 😃 .

Regards

[ruant]

Just want to chime in my wish for this request as well.
Worth noting that i hope this also adds support for the other operators, like "IS", and not just from the value list.
E.g "file.directory" IS "C:\Some*\Wildcard\Path"