diff --git a/docs/detections/api/exceptions/api-find-exception-containers.asciidoc b/docs/detections/api/exceptions/api-find-exception-containers.asciidoc index a0b6e8dfd5..da709a6805 100644 --- a/docs/detections/api/exceptions/api-find-exception-containers.asciidoc +++ b/docs/detections/api/exceptions/api-find-exception-containers.asciidoc @@ -34,15 +34,22 @@ See {ref}/search-request-body.html#request-body-search-search-after[Search After associated with a {kib} space or available in all spaces (`agnostic` or `single`). -|`filter` |String a|Filters the returned results according to the value of the -specified field, using the `:` syntax, where -`` can be: +|`filter` |String a|Filters the returned results according to the value of the specified field. + +Uses the `so type.field name:field value` syntax, where `so type` can be: + +* `exception-list`: Specify a space-aware exception list. +* `exception-list-agnostic`: Specify an exception list that is shared across spaces. + +And `field name` can be: * `name` * `type` * `created_by` * `updated_by` +|`search` |String a|Filters the returned results according to the {ref}/query-dsl-simple-query-string-query.html#simple-query-string-syntax[simple query] filter. + |============================================== ===== Example request