Skip to content

[8.5] [DOCS] Value list exceptions for all rule types (backport #2562) #2596

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 18, 2022
Merged

[8.5] [DOCS] Value list exceptions for all rule types (backport #2562) #2596

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions docs/detections/detections-ui-exceptions.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,15 +21,18 @@ with these types:
After creating value lists, you can use `is in list` and `is not in list`
operators to define exceptions.

IMPORTANT: Operators `is in list` and `is not in list` are not available for
threshold and event correlation rules.

TIP: You can also use value lists as the <<indicator-value-lists,indicator match index>> when creating an indicator match rule.

[float]
[[manage-value-lists]]
== Create value lists

When creating a value list for a rule exception, be mindful of the list's size and data type. In general, all rule types support value list exceptions, but there are some limitations for especially large lists or certain data types. The following value list types can _only_ be used with custom query, machine learning, and indicator match rule types:

* Keyword or IP address lists with more than 65,536 values
* IP range lists with more than 200 dash notation values (for example, `127.0.0.1-127.0.0.4` is one value) or more than 65,536 CIDR notation values
* Text data type lists of any size

To create a value list:

. Prepare a `txt` or `csv` file with all the values you want to use for
Expand Down Expand Up @@ -129,8 +132,9 @@ image::images/add-exception-ui.png[]
+
[NOTE]
=======
* An exception defined by a value list must use `is in list` or `is not in list` in all conditions.
* An exception defined by a value list must use `is in list` or `is not in list` in all conditions.
* Wildcards are not supported in value lists.
* If a value list can't be used due to <<manage-value-lists,size or data type>>, it'll be unavailable in the *Value* menu.
=======
* `matches` | `does not match` — Allows you to use wildcards in *Value*, such as `C:\path\*\app.exe`. Available wildcards are `?` (match one character) and `*` (match zero or more characters). The selected *Field* data type must be {ref}/keyword.html#keyword-field-type[keyword], {ref}/text.html#text-field-type[text], or {ref}/keyword.html#wildcard-field-type[wildcard].
+
Expand Down