First draft

elastic · Nov 29, 2023 · ac5779c · ac5779c
1 parent 2bfd615
commit ac5779c
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/docs/detections/rules-ui-create.asciidoc b/docs/detections/rules-ui-create.asciidoc
@@ -177,6 +177,9 @@ NOTE: {elastic-sec} provides limited support for indicator match rules. See <<su
 
 . Go to *Rules* -> *Detection rules (SIEM)* -> *Create new rule*. The *Create new rule* page displays.
 . To create a rule that searches for events whose specified field value matches the specified indicator field value in the indicator index patterns, select *Indicator Match*, then fill in the following fields:
++
+NOTE: Only single-value fields are supported.
++
 .. *Source*: The individual index patterns or data view that specifies what data to search.
 .. *Custom query*: The query and filters used to retrieve the required results from
 the {elastic-sec} event indices. For example, if you want to match documents that only contain a `destination.ip` address field, add `destination.ip : *`.