diff --git a/docs/detections/api/exceptions/api-create-exception-item.asciidoc b/docs/detections/api/exceptions/api-create-exception-item.asciidoc index 3f2901c393..faa6d8192f 100644 --- a/docs/detections/api/exceptions/api-create-exception-item.asciidoc +++ b/docs/detections/api/exceptions/api-create-exception-item.asciidoc @@ -43,7 +43,7 @@ A JSON object with these fields: exception queries. Boolean `AND` logic is used to evaluate the relationship between array elements. If you want to use `OR` logic, create a separate exception item. |Yes -|`expire_time` |String |An expiration date in ISO format. |No +|`expire_time` |String |The exception item's expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. |No |`list_id` |String |ID of the associated <>. |Yes |`item_id` |String |Unique identifier of the exception item. |No, automatically created when it is not provided. diff --git a/docs/detections/api/exceptions/api-update-exception-item.asciidoc b/docs/detections/api/exceptions/api-update-exception-item.asciidoc index a4982ef2d6..f244edd525 100644 --- a/docs/detections/api/exceptions/api-update-exception-item.asciidoc +++ b/docs/detections/api/exceptions/api-update-exception-item.asciidoc @@ -26,7 +26,7 @@ When unspecified, a new comment is created. exception queries. Boolean `AND` logic is used to evaluate the relationship between array elements. If you want to use `OR` logic, create a separate exception item. |Yes -|`expire_time` |String |An expiration date in ISO format. |No +|`expire_time` |String |The exception item's expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. |No |`id` |String |The item's unique identifier. |Yes, when the item's `item_id` field is not used. |`item_id` |String |The `item_id` of the item you are updating. |Yes, when the item's `id` field is not used.