Skip to content

Commit

Permalink
[Redo][8.4] Highlight that rule exceptions are case-sensitive (#4837)
Browse files Browse the repository at this point in the history
  • Loading branch information
nastasha-solomon authored Feb 20, 2024
1 parent 13ffb52 commit a44753f
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions docs/detections/detections-ui-exceptions.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -119,6 +119,8 @@ The *Add Rule Exception* flyout opens (the example below was opened from the Ale
image::images/add-exception-ui.png[]
. Use the following settings to add conditions that define when the exception prevents alerts. In the example above, the exception prevents the rule from generating alerts when the
`svchost.exe` process runs on agent hostname `siem-kibana`.
+
IMPORTANT: Rule exceptions are case-sensitive, which means that any character that's entered as an uppercase or lowercase letter will be treated as such. In the event you _don't_ want a field evaluated as case-sensitive, some ECS fields have a `.caseless` version that you can use.

.. *Field*: Select a field to identify the event being filtered.

Expand Down Expand Up @@ -204,6 +206,8 @@ The *Add Endpoint Exception* flyout opens, from either the rule details page or
image::images/endpoint-add-exp.png[]
. If required, modify the conditions.
+
IMPORTANT: Rule exceptions are case-sensitive, which means that any character that's entered as an uppercase or lowercase letter will be treated as such. In the event you _don't_ want a field evaluated as case-sensitive, some ECS fields have a `.caseless` version that you can use.
+
NOTE: Refer to <<ex-nested-conditions>> for more information on when nested conditions are required.

. You can select any of the following:
Expand Down

0 comments on commit a44753f

Please sign in to comment.