Skip to content

Commit 50e4a39

Browse files
[8.12] [ESS][Pt. Duex] Adding value list file size constraints to UI docs (backport #5001) (#5250)
* First draft * Input from Yara * Update docs/detections/value-list-exceptions.asciidoc * Update docs/detections/value-list-exceptions.asciidoc * Remove duplicated content (cherry picked from commit 2e9f4b1) Co-authored-by: Nastasha Solomon <[email protected]>
1 parent 8c8b7b4 commit 50e4a39

File tree

1 file changed

+7
-4
lines changed

1 file changed

+7
-4
lines changed

docs/detections/value-list-exceptions.asciidoc

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,12 @@ TIP: You can also use a value list as the <<indicator-value-lists,indicator matc
1717
[float]
1818
[[manage-value-lists]]
1919
=== Create value lists
20-
When creating a value list for a rule exception, be mindful of the list's size and data type. In general, all rule types support value list exceptions, but there are some limitations for especially large lists or certain data types. The following value list types can _only_ be used with custom query, machine learning, and indicator match rule types:
20+
When you create a value list for a rule exception, be mindful of the list's size and data type. All rule types support value list exceptions, but extremely large lists or certain data types have limitations.
2121

22-
* Keyword or IP address lists with more than 65,536 values
23-
* IP range lists with more than 200 dash notation values (for example, `127.0.0.1-127.0.0.4` is one value) or more than 65,536 CIDR notation values
24-
* Text data type lists of any size
22+
Custom query, machine learning, and indicator match rules support the following value list types and sizes:
23+
24+
* **Keywords** or **IP addresses** list types with more than 65,536 values
25+
* **IP ranges** list type with over 200 dash notation values (for example, `127.0.0.1-127.0.0.4` is one value) or more than 65,536 CIDR notation values
2526

2627
To create a value list:
2728

@@ -34,6 +35,8 @@ act as delimiters.
3435
* All values in the file must be of the same {es} type.
3536
3637
* Wildcards are not supported in value lists. Values must be literal values.
38+
39+
* The maximum accepted file size is 9 million bytes.
3740
=========================
3841

3942
. Go to *Rules* -> *Detection rules (SIEM)*.

0 commit comments

Comments
 (0)