Skip to content

Commit 9d67ba5

Browse files
[Redo][8.2] Highlight that rule exceptions are case-sensitive (#4839)
* Creating backport * Update docs/detections/detections-ui-exceptions.asciidoc
1 parent 172294a commit 9d67ba5

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

docs/detections/detections-ui-exceptions.asciidoc

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,10 +123,10 @@ the exception prevents the rule from generating alerts when the
123123
+
124124
[IMPORTANT]
125125
============
126+
* Rule exceptions are case-sensitive, which means that any character that's entered as an uppercase or lowercase letter will be treated as such. In the event you _don't_ want a field evaluated as case-sensitive, some ECS fields have a `.caseless` version that you can use.
126127
* You can use nested conditions. However, this is only required for
127128
<<nested-field-list, these fields>>. For all other fields, nested conditions
128129
should not be used.
129-
130130
* Wildcards are not supported in rule exceptions or value lists. Values must be literal values.
131131
============
132132
+
@@ -196,6 +196,8 @@ The *Add Endpoint Exception* flyout opens, from either the rule details page or
196196
image::images/endpoint-add-exp.png[]
197197
. If required, modify the conditions.
198198
+
199+
IMPORTANT: Rule exceptions are case-sensitive, which means that any character that's entered as an uppercase or lowercase letter will be treated as such. In the event you _don't_ want a field evaluated as case-sensitive, some ECS fields have a `.caseless` version that you can use.
200+
+
199201
NOTE: See <<ex-nested-conditions>> for more information on when nested conditions are required.
200202

201203
. You can select any of the following:

0 commit comments

Comments
 (0)