diff --git a/docs/detections/api/rules/rules-api-export.asciidoc b/docs/detections/api/rules/rules-api-export.asciidoc index 8c4c446920..cccd664cfd 100644 --- a/docs/detections/api/rules/rules-api-export.asciidoc +++ b/docs/detections/api/rules/rules-api-export.asciidoc @@ -14,7 +14,7 @@ Rule actions and connectors are included in the exported file, but sensitive inf You can use {kib}'s {kibana-ref}/managing-saved-objects.html#managing-saved-objects-export-objects[Saved Objects] UI (*Stack Management* -> *Kibana* -> *Saved Objects*) or the Saved Objects APIs (experimental) to {kibana-ref}/saved-objects-api-export.html[export] and {kibana-ref}/saved-objects-api-import.html[import] any necessary connectors before importing detection rules. -Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the <> UI (*Rules* -> *Detection rules (SIEM)* -> *Import value lists*) to export and import value lists separately. +Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the <> UI (*Rules* -> *Detection rules (SIEM)* -> *Manage value lists*) to export and import value lists separately. ================= ==== Request URL diff --git a/docs/detections/api/rules/rules-api-import.asciidoc b/docs/detections/api/rules/rules-api-import.asciidoc index 5f73a62bf3..0ac2bf2f49 100644 --- a/docs/detections/api/rules/rules-api-import.asciidoc +++ b/docs/detections/api/rules/rules-api-import.asciidoc @@ -21,7 +21,7 @@ Rule actions and connectors are included in the exported file, but sensitive inf You can use {kib}'s {kibana-ref}/managing-saved-objects.html#managing-saved-objects-export-objects[Saved Objects] UI (*Stack Management* -> *Kibana* -> *Saved Objects*) or the Saved Objects APIs (experimental) to {kibana-ref}/saved-objects-api-export.html[export] and {kibana-ref}/saved-objects-api-import.html[import] any necessary connectors before importing detection rules. -Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the <> UI (*Rules* -> *Detection rules (SIEM)* -> *Import value lists*) to export and import value lists separately. +Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the <> UI (*Rules* -> *Detection rules (SIEM)* -> *Manage value lists*) to export and import value lists separately. ================= ==== Request URL diff --git a/docs/detections/images/all-rules.png b/docs/detections/images/all-rules.png index 26eeefa0b0..5ad7137a53 100644 Binary files a/docs/detections/images/all-rules.png and b/docs/detections/images/all-rules.png differ diff --git a/docs/detections/images/cancel-value-list-item-changes.png b/docs/detections/images/cancel-value-list-item-changes.png new file mode 100644 index 0000000000..cf03c456e0 Binary files /dev/null and b/docs/detections/images/cancel-value-list-item-changes.png differ diff --git a/docs/detections/images/edit-value-list-item.png b/docs/detections/images/edit-value-list-item.png new file mode 100644 index 0000000000..dc189cc790 Binary files /dev/null and b/docs/detections/images/edit-value-list-item.png differ diff --git a/docs/detections/images/edit-value-lists.png b/docs/detections/images/edit-value-lists.png new file mode 100644 index 0000000000..dd53a8dc11 Binary files /dev/null and b/docs/detections/images/edit-value-lists.png differ diff --git a/docs/detections/images/export-value-list.png b/docs/detections/images/export-value-list.png new file mode 100644 index 0000000000..862703fbbe Binary files /dev/null and b/docs/detections/images/export-value-list.png differ diff --git a/docs/detections/images/manage-value-list.png b/docs/detections/images/manage-value-list.png index 76ed53b05f..7b65290ccf 100644 Binary files a/docs/detections/images/manage-value-list.png and b/docs/detections/images/manage-value-list.png differ diff --git a/docs/detections/images/monitor-table.png b/docs/detections/images/monitor-table.png index 4a1ad1dda5..05cb4c3aa2 100644 Binary files a/docs/detections/images/monitor-table.png and b/docs/detections/images/monitor-table.png differ diff --git a/docs/detections/images/prebuilt-rules-add-badge.png b/docs/detections/images/prebuilt-rules-add-badge.png index a305df45ce..d82a3f2d39 100644 Binary files a/docs/detections/images/prebuilt-rules-add-badge.png and b/docs/detections/images/prebuilt-rules-add-badge.png differ diff --git a/docs/detections/images/prebuilt-rules-update.png b/docs/detections/images/prebuilt-rules-update.png index b972b867d3..ade5071b55 100644 Binary files a/docs/detections/images/prebuilt-rules-update.png and b/docs/detections/images/prebuilt-rules-update.png differ diff --git a/docs/detections/images/remove-value-list-item.png b/docs/detections/images/remove-value-list-item.png new file mode 100644 index 0000000000..7f998809a7 Binary files /dev/null and b/docs/detections/images/remove-value-list-item.png differ diff --git a/docs/detections/images/remove-value-list.png b/docs/detections/images/remove-value-list.png new file mode 100644 index 0000000000..b8fbd49bdf Binary files /dev/null and b/docs/detections/images/remove-value-list.png differ diff --git a/docs/detections/images/save-value-list-item-changes.png b/docs/detections/images/save-value-list-item-changes.png new file mode 100644 index 0000000000..6316485e97 Binary files /dev/null and b/docs/detections/images/save-value-list-item-changes.png differ diff --git a/docs/detections/images/upload-lists-ui.png b/docs/detections/images/upload-lists-ui.png index b9e5f75e9f..37554f0e40 100644 Binary files a/docs/detections/images/upload-lists-ui.png and b/docs/detections/images/upload-lists-ui.png differ diff --git a/docs/detections/rules-ui-create.asciidoc b/docs/detections/rules-ui-create.asciidoc index 46bb76974e..936bb7570e 100644 --- a/docs/detections/rules-ui-create.asciidoc +++ b/docs/detections/rules-ui-create.asciidoc @@ -234,7 +234,7 @@ You uploaded a value list of known ransomware domains, and you want to be notifi * *Field*: Enter the field from the Elastic Security event indices to be used for comparing values. * *Indicator index field*: Enter the type of value list you created (i.e., `keyword`, `text`, or `IP`). + -TIP: If you don't remember this information, go to *Rules* -> *Detection rules (SIEM)* -> *Import value lists*. Locate the appropriate value list and note the field in the corresponding `Type` column. (Examples include keyword, text, and IP.) +TIP: If you don't remember this information, go to *Rules* -> *Detection rules (SIEM)* -> *Manage value lists*. Locate the appropriate value list and note the field in the corresponding `Type` column. (Examples include keyword, text, and IP.) [role="screenshot"] image::images/indicator_value_list.png[] diff --git a/docs/detections/rules-ui-manage.asciidoc b/docs/detections/rules-ui-manage.asciidoc index ff1af14d36..9e83a61de4 100644 --- a/docs/detections/rules-ui-manage.asciidoc +++ b/docs/detections/rules-ui-manage.asciidoc @@ -138,7 +138,7 @@ To import into a different {stack} deployment, the destination cluster must incl + TIP: You can also use {kib}'s {kibana-ref}/managing-saved-objects.html#managing-saved-objects-export-objects[Saved Objects] UI (*Stack Management* -> *Kibana* -> *Saved Objects*) to export and import necessary connectors before importing detection rules. -- *Value lists*: Any value lists used for rule exceptions are _not_ included in rule exports or imports. Use the <> UI (*Rules* -> *Detection rules (SIEM)* -> *Import value lists*) to export and import value lists separately. +- *Value lists*: Any value lists used for rule exceptions are _not_ included in rule exports or imports. Use the <> UI (*Rules* -> *Detection rules (SIEM)* -> *Manage value lists*) to export and import value lists separately. To export and import detection rules: diff --git a/docs/detections/value-list-exceptions.asciidoc b/docs/detections/value-list-exceptions.asciidoc index 6bf097abae..14e666480f 100644 --- a/docs/detections/value-list-exceptions.asciidoc +++ b/docs/detections/value-list-exceptions.asciidoc @@ -15,7 +15,7 @@ After creating value lists, you can use `is in list` and `is not in list` operat TIP: You can also use a value list as the <> when creating an indicator match rule. [float] -[[manage-value-lists]] +[[create-value-lists]] === Create value lists When creating a value list for a rule exception, be mindful of the list's size and data type. In general, all rule types support value list exceptions, but there are some limitations for especially large lists or certain data types. The following value list types can _only_ be used with custom query, machine learning, and indicator match rule types: @@ -37,27 +37,54 @@ act as delimiters. ========================= . Go to *Rules* -> *Detection rules (SIEM)*. -. Click *Import value lists*. The *Import value lists* window opens. +. Click *Manage value lists*. The *Manage value lists* window opens. + [role="screenshot"] -image::images/upload-lists-ui.png[Import value lists flyout,75%] +image::images/upload-lists-ui.png[Manage value lists flyout,75%] . Select the list type (*Keywords*, *IP addresses*, *IP ranges*, or *Text*) from the *Type of value list* drop-down. . Drag or select the `csv` or `txt` file that contains the values. . Click *Import value list*. -NOTE: When the name of the file you are importing already exists, the values in -the new file are appended to the previously imported values. +NOTE: If you import a file with a name that already exists, a new list is not created. The imported values are added to the existing list instead. -[[edit-value-lists]] +[[manage-value-lists]] [discrete] === Manage value lists -To view, delete, or export existing value lists: +You can edit, remove, or export existing value lists. + +[[edit-value-lists]] +[discrete] +==== Edit value lists + +. Go to **Rules** → **Detection rules (SIEM)**. +. Click **Manage value lists**. The **Manage value lists** window opens. +. In the **Value lists** table, click the value list you want to edit. +. Do any of the following: + +** **Filter items in the list**: Use the KQL search bar to find values in the list. Depending on your list's type, you can filter by the `keyword`, `ip_range`, `ip`, or `text` fields. For example, to filter by Gmail addresses in a value list of the `keyword` type, enter `keyword:*gmail.com` into the search bar. ++ +You can also filter by the `updated_by` field (for example, `updated_by:testuser`), or the `updated at` field (for example, `updated_at < now`). +** **Add individual items to the list**: Click **Create list item**, enter a value, then click **Add list item**. +** **Bulk upload list items**: Drag or select the `csv` or `txt` file that contains the values that you want to add, then click **Upload**. +** **Edit a value**: In the Value column, go to the value you want to edit and click the **Edit** button (image:images/edit-value-list-item.png[Edit button from Manage value lists window,15,15]). When you're done editing, click the **Save** button (image:images/save-value-list-item-changes.png[Save button from Manage value lists window,18,18]) to save your changes. Click the **Cancel** button (image:images/cancel-value-list-item-changes.png[Cancel button from Manage value lists window,18,18]) to revert your changes. +** **Remove a value**: Click the **Remove value** button (image:images/remove-value-list-item.png[Remove value list button from Manage value lists window,15,15]) to delete a value from the list. + +[role="screenshot"] +image::images/edit-value-lists.png[Manage items in a value lists,75%] + +TIP: You can also edit value lists while creating and managing exceptions that use value lists. + +[[export-remove-value-lists]] +[discrete] +==== Export or remove value lists . Go to *Rules* -> *Detection rules (SIEM)*. -. Click *Import value lists*. The *Import value lists* window opens. -. In the *Value lists* table, click the required action button. +. Click *Manage value lists*. The *Manage value lists* window opens. +. From the *Value lists* table, you can: +.. Click the **Export value list** button (image:images/export-value-list.png[Export button from Manage value lists window,15,15]) to export the value list. +.. Click the **Remove value list** button (image:images/remove-value-list.png[Remove button from Manage value lists window,15,15]) to delete the value list. + [role="screenshot"] image::images/manage-value-list.png[Import value list flyout with action buttons highlighted,75%] \ No newline at end of file