Clarifies that expire_time is not available for endpoint exceptions (…

…#3856) (#3894) * Clarifies that expire_time is not available for endpoint exceptions * TW review updates (cherry picked from commit 5182f16) Co-authored-by: natasha-moore-elastic <[email protected]>
elastic · Sep 9, 2023 · e876513 · e876513
1 parent 323ce54
commit e876513
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/docs/detections/api/exceptions/api-create-exception-item.asciidoc b/docs/detections/api/exceptions/api-create-exception-item.asciidoc
@@ -43,7 +43,7 @@ A JSON object with these fields:
 exception queries. Boolean `AND` logic is used to evaluate the relationship
 between array elements. If you want to use `OR` logic, create a separate
 exception item. |Yes
-|`expire_time` |String |An expiration date in ISO format. |No
+|`expire_time` |String |The exception item's expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. |No
 |`list_id` |String |ID of the associated <<exceptions-api-create-container, exception container>>. |Yes
 |`item_id` |String |Unique identifier of the exception item. |No, automatically
 created when it is not provided.

diff --git a/docs/detections/api/exceptions/api-update-exception-item.asciidoc b/docs/detections/api/exceptions/api-update-exception-item.asciidoc
@@ -26,7 +26,7 @@ When unspecified, a new comment is created.
 exception queries. Boolean `AND` logic is used to evaluate the relationship
 between array elements. If you want to use `OR` logic, create a separate
 exception item. |Yes
-|`expire_time` |String |An expiration date in ISO format. |No
+|`expire_time` |String |The exception item's expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions. |No
 |`id` |String |The item's unique identifier. |Yes, when the item's `item_id` field is not used.
 |`item_id` |String |The `item_id` of the item you are updating. |Yes, when
 the item's `id` field is not used.