Skip to content

Commit e572f70

Browse files
[8.1] [Redo][7.17-8.5] Highlight that rule exceptions are case-sensitive (#4806) (#4919)
1 parent ce5f2d2 commit e572f70

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

docs/detections/detections-ui-exceptions.asciidoc

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,8 @@ the exception prevents the rule from generating alerts when the
123123
+
124124
[IMPORTANT]
125125
============
126+
* Rule exceptions are case-sensitive, which means that any character that's entered as an uppercase or lowercase letter will be treated as such. In the event you _don't_ want a field evaluated as case-sensitive, some ECS fields have a `.caseless` version that you can use.
127+
126128
* You can use nested conditions. However, this is only required for
127129
<<nested-field-list, these fields>>. For all other fields, nested conditions
128130
should not be used.
@@ -197,6 +199,9 @@ image::images/endpoint-add-exp.png[]
197199
. If required, modify the conditions.
198200
+
199201
NOTE: See <<ex-nested-conditions>> for more information on when nested conditions are required.
202+
+
203+
IMPORTANT: Rule exceptions are case-sensitive, which means that any character that's entered as an uppercase or lowercase letter will be treated as such. In the event you _don't_ want a field evaluated as case-sensitive, some ECS fields have a `.caseless` version that you can use.
204+
200205

201206
. You can select any of the following:
202207

@@ -301,4 +306,3 @@ To export or delete an exception list, select the required action button on the
301306

302307
[role="screenshot"]
303308
image::images/actions-exception-list.png[Detail of Exception lists table with export and delete buttons highlighted,400]
304-

0 commit comments

Comments
 (0)