Skip to content

Commit 19ddcc1

Browse files
[DOCS] Value list exceptions for all rule types (#2562) (#2596)
* Update detections-ui-exceptions.asciidoc * Smol edits * Apply suggestions from Janeen's review Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Apply suggestions from Marshall's review Co-authored-by: Marshall Main <55718608+marshallmain@users.noreply.github.com> Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> Co-authored-by: Marshall Main <55718608+marshallmain@users.noreply.github.com> (cherry picked from commit c85062b) Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
1 parent 3decc8d commit 19ddcc1

File tree

1 file changed

+8
-4
lines changed

1 file changed

+8
-4
lines changed

docs/detections/detections-ui-exceptions.asciidoc

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,15 +21,18 @@ with these types:
2121
After creating value lists, you can use `is in list` and `is not in list`
2222
operators to define exceptions.
2323

24-
IMPORTANT: Operators `is in list` and `is not in list` are not available for
25-
threshold and event correlation rules.
26-
2724
TIP: You can also use value lists as the <<indicator-value-lists,indicator match index>> when creating an indicator match rule.
2825

2926
[float]
3027
[[manage-value-lists]]
3128
== Create value lists
3229

30+
When creating a value list for a rule exception, be mindful of the list's size and data type. In general, all rule types support value list exceptions, but there are some limitations for especially large lists or certain data types. The following value list types can _only_ be used with custom query, machine learning, and indicator match rule types:
31+
32+
* Keyword or IP address lists with more than 65,536 values
33+
* IP range lists with more than 200 dash notation values (for example, `127.0.0.1-127.0.0.4` is one value) or more than 65,536 CIDR notation values
34+
* Text data type lists of any size
35+
3336
To create a value list:
3437

3538
. Prepare a `txt` or `csv` file with all the values you want to use for
@@ -129,8 +132,9 @@ image::images/add-exception-ui.png[]
129132
+
130133
[NOTE]
131134
=======
132-
* An exception defined by a value list must use `is in list` or `is not in list` in all conditions.
135+
* An exception defined by a value list must use `is in list` or `is not in list` in all conditions.
133136
* Wildcards are not supported in value lists.
137+
* If a value list can't be used due to <<manage-value-lists,size or data type>>, it'll be unavailable in the *Value* menu.
134138
=======
135139
* `matches` | `does not match` — Allows you to use wildcards in *Value*, such as `C:\path\*\app.exe`. Available wildcards are `?` (match one character) and `*` (match zero or more characters). The selected *Field* data type must be {ref}/keyword.html#keyword-field-type[keyword], {ref}/text.html#text-field-type[text], or {ref}/keyword.html#wildcard-field-type[wildcard].
136140
+

0 commit comments

Comments
 (0)