Skip to content

Commit 89cfee5

Browse files
[BUG][7.17-8.5]Fix note that describes how exceptions work with EQL rules (backport #4759) (#4770)
* [BUG][7.17-8.5]Fix note that describes how exceptions work with EQL rules (#4759) (cherry picked from commit 7d74705) # Conflicts: # docs/detections/detections-ui-exceptions.asciidoc * Fixed! --------- Co-authored-by: Nastasha Solomon <[email protected]> Co-authored-by: nastasha.solomon <[email protected]>
1 parent fb8bf83 commit 89cfee5

File tree

1 file changed

+2
-3
lines changed

1 file changed

+2
-3
lines changed

docs/detections/detections-ui-exceptions.asciidoc

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -81,10 +81,9 @@ IMPORTANT: To ensure an exception is successfully applied, make sure that the f
8181

8282
[IMPORTANT]
8383
==============
84-
Be careful when adding exceptions to event correlation rules. Exceptions are evaluated against every event in the sequence, and when the exception matches _all_ event(s) in the sequence, alerts _are not_ generated. If the exception only matches _some_ of the events in the sequence, alerts _are_ generated.
84+
Be careful when adding exceptions to <<create-eql-rule,event correlation>> rules. Exceptions are evaluated against every event in the sequence, and if an exception matches any events that are necessary to complete the sequence, alerts are not created.
8585
86-
To exclude values from a
87-
specific event in the sequence, update the rule's EQL statement. For example:
86+
To exclude values from a specific event in the sequence, update the rule's EQL statement. For example:
8887
8988
[source,eql]
9089
----

0 commit comments

Comments
 (0)