Skip to content

Commit

Permalink
UI updated for unmapped fields and fields with type conflicts (#3574)
Browse files Browse the repository at this point in the history
  • Loading branch information
nastasha-solomon authored Jul 27, 2023
1 parent 85c49aa commit 568f369
Show file tree
Hide file tree
Showing 3 changed files with 13 additions and 2 deletions.
8 changes: 7 additions & 1 deletion docs/detections/add-exceptions.asciidoc
Original file line number Diff line number Diff line change
@@ -1,5 +1,11 @@
[[add-exceptions]]
== Add and manage exceptions

:frontmatter-description: Explains how to add and manage rule exceptions from a rule's details page, alerts, or the Exception Lists page.
:frontmatter-tags-products: [security]
:frontmatter-tags-content-type: [how-to]
:frontmatter-tags-user-goals: [configure]

You can add exceptions to a rule from the rule details page, the Alerts table, the alert details flyout, or the Shared Exception Lists page. When you add an exception, you can also close all alerts that meet the exception’s criteria.

[IMPORTANT]
Expand Down Expand Up @@ -62,7 +68,7 @@ NOTE: When you create a new exception from an alert, exception conditions are au
+
[NOTE]
=======
Fields with conflicts are marked with a warning icon (image:images/field-warning-icon.png[Field conflict warning icon,13,13]). Using these fields and might cause unexpected exceptions behavior. For more information, refer to <<rule-exceptions-field-conflicts,Troubleshooting type conflicts and unmapped fields>>.
A warning displays for fields with conflicts. Using these fields might cause unexpected exceptions behavior. Refer to <<rule-exceptions-field-conflicts,Troubleshooting type conflicts and unmapped fields>> for more information.
=======

.. *Operator*: Select an operator to define the condition:
Expand Down
7 changes: 6 additions & 1 deletion docs/troubleshooting/detections/detection-rules.asciidoc
Original file line number Diff line number Diff line change
@@ -1,6 +1,11 @@
[[ts-detection-rules]]
== Detection rules

:frontmatter-description: Covers common troubleshooting issues when creating or managing detection rules.
:frontmatter-tags-products: [security]
:frontmatter-tags-content-type: [troubleshooting]
:frontmatter-tags-user-goals: [configure]

This topic covers common troubleshooting issues when creating or managing <<rules-ui-create, detection rules>>.

[discrete]
Expand Down Expand Up @@ -83,7 +88,7 @@ CAUTION: Turning off `autocomplete:useTimeRange` could cause performance issues
[%collapsible]
====
A warning icon (image:images/field-warning-icon.png[Field conflict warning icon,13,13]) and message appear for fields with <<fields-with-conflicting-types,type conflicts>> across multiple indices or are <<unmapped-field-conflict,unmapped fields>>. You can learn more about the conflict by hovering over the field. After you select it, the warning message appears beneath the field.
A warning icon (image:images/field-warning-icon.png[Field conflict warning icon,13,13]) and message appear for fields with <<fields-with-conflicting-types,type conflicts>> across multiple indices or fields that are <<unmapped-field-conflict,unmapped>>. You can learn more about the conflict by clicking the warning message.
NOTE: A field can have type conflicts _and_ be unmapped in specified indices.
Expand Down
Binary file modified docs/troubleshooting/images/warning-icon-message.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit 568f369

Please sign in to comment.