From 7a1c99fb0ccf84fd006a91215e65b3acdb4884a7 Mon Sep 17 00:00:00 2001
From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com>
Date: Mon, 20 May 2024 17:42:13 -0400
Subject: [PATCH] [8.14] [ESS][Pt. Duex] Adding value list file size
 constraints to UI docs (backport #5001) (#5248)

* First draft

* Input from Yara

* Update docs/detections/value-list-exceptions.asciidoc

* Update docs/detections/value-list-exceptions.asciidoc

* Remove duplicated content

(cherry picked from commit 2e9f4b14fcb779d19322fa3d52bfaf3d1c01d24b)

Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>
---
 docs/detections/value-list-exceptions.asciidoc | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/docs/detections/value-list-exceptions.asciidoc b/docs/detections/value-list-exceptions.asciidoc
index 14e666480f..609c2ef095 100644
--- a/docs/detections/value-list-exceptions.asciidoc
+++ b/docs/detections/value-list-exceptions.asciidoc
@@ -17,11 +17,12 @@ TIP: You can also use a value list as the <<indicator-value-lists,indicator matc
 [float]
 [[create-value-lists]]
 === Create value lists
-When creating a value list for a rule exception, be mindful of the list's size and data type. In general, all rule types support value list exceptions, but there are some limitations for especially large lists or certain data types. The following value list types can _only_ be used with custom query, machine learning, and indicator match rule types:
+When you create a value list for a rule exception, be mindful of the list's size and data type. All rule types support value list exceptions, but extremely large lists or certain data types have limitations. 
 
-* Keyword or IP address lists with more than 65,536 values
-* IP range lists with more than 200 dash notation values (for example, `127.0.0.1-127.0.0.4` is one value) or more than 65,536 CIDR notation values
-* Text data type lists of any size
+Custom query, machine learning, and indicator match rules support the following value list types and sizes:
+
+* **Keywords** or **IP addresses** list types with more than 65,536 values
+* **IP ranges** list type with over 200 dash notation values (for example, `127.0.0.1-127.0.0.4` is one value) or more than 65,536 CIDR notation values
 
 To create a value list:
 
@@ -34,6 +35,8 @@ act as delimiters.
 * All values in the file must be of the same {es} type.
 
 * Wildcards are not supported in value lists. Values must be literal values.
+
+* The maximum accepted file size is 9 million bytes.
 =========================
 
 . Go to *Rules* -> *Detection rules (SIEM)*.