Skip to content

Commit

Permalink
[Redo][7.17-8.5] Highlight that rule exceptions are case-sensitive (#…
Browse files Browse the repository at this point in the history
…4806)

# Conflicts:
#	docs/detections/detections-ui-exceptions.asciidoc
  • Loading branch information
nastasha-solomon committed Mar 14, 2024
1 parent 172d3a7 commit 13073d7
Showing 1 changed file with 4 additions and 1 deletion.
5 changes: 4 additions & 1 deletion docs/detections/detections-ui-exceptions.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -122,6 +122,8 @@ the exception prevents the rule from generating alerts when the
+
[IMPORTANT]
============
* Rule exceptions are case-sensitive, which means that any character that's entered as an uppercase or lowercase letter will be treated as such. In the event you _don't_ want a field evaluated as case-sensitive, some ECS fields have a `.caseless` version that you can use.
* You can use nested conditions. However, this is only required for
<<nested-field-list, these fields>>. For all other fields, nested conditions
should not be used.
Expand Down Expand Up @@ -196,6 +198,8 @@ image::images/endpoint-add-exp.png[]
. If required, modify the conditions.
+
NOTE: See <<ex-nested-conditions>> for more information on when nested conditions are required.
+
IMPORTANT: Rule exceptions are case-sensitive, which means that any character that's entered as an uppercase or lowercase letter will be treated as such. In the event you _don't_ want a field evaluated as case-sensitive, some ECS fields have a `.caseless` version that you can use.

. You can select any of the following:

Expand Down Expand Up @@ -300,4 +304,3 @@ To export or delete an exception list, select the required action button on the

[role="screenshot"]
image::images/actions-exception-list.png[Detail of Exceptions table with export and delete buttons highlighted,400]

0 comments on commit 13073d7

Please sign in to comment.