You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Create and manage value lists[value-lists-exceptions]
8
8
9
-
% What needs to be done: Lift-and-shift
9
+
Value lists hold multiple values of the same Elasticsearch data type, such as IP addresses, which are used to determine when an exception prevents an alert from being generated. You can use value lists to define exceptions for detection rules; however, you cannot use value lists to define endpoint rule exceptions.
10
10
11
-
% Use migrated content from existing pages that map to this page:
11
+
Value lists are lists of items with the same {{es}} [data type](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-types.html). You can create value lists with these types:
*`Keywords` (many [ECS fields](https://www.elastic.co/guide/en/ecs/{{ecs_version}}/ecs-field-reference.html) are keywords)
14
+
*`IP Addresses`
15
+
*`IP Ranges`
16
+
*`Text`
15
17
16
-
% Internal links rely on the following IDs being on this page (e.g. as a heading ID, paragraph ID, etc):
18
+
After creating value lists, you can use `is in list` and `is not in list` operators to [define exceptions](add-manage-exceptions.md).
17
19
18
-
$$$create-value-lists$$$
20
+
::::{tip}
21
+
You can also use a value list as the [indicator match index](create-detection-rule.md#indicator-value-lists) when creating an indicator match rule.
22
+
::::
19
23
20
-
$$$edit-value-lists$$$
24
+
## Create value lists [create-value-lists]
21
25
22
-
$$$manage-value-lists$$$
26
+
When you create a value list for a rule exception, be mindful of the list’s size and data type. All rule types support value list exceptions, but extremely large lists or certain data types have limitations.
27
+
28
+
Custom query, machine learning, and indicator match rules support the following value list types and sizes:
29
+
30
+
***Keywords** or **IP addresses** list types with more than 65,536 values
31
+
***IP ranges** list type with over 200 dash notation values (for example, `127.0.0.1-127.0.0.4` is one value) or more than 65,536 CIDR notation values
32
+
33
+
To create a value list:
34
+
35
+
1. Prepare a `txt` or `csv` file with all the values you want to use for determining exceptions from a single list. If you use a `txt` file, new lines act as delimiters.
36
+
37
+
::::{important}
38
+
* All values in the file must be of the same {{es}} type.
39
+
* Wildcards are not supported in value lists. Values must be literal values.
40
+
* The maximum accepted file size is 9 million bytes.
41
+
42
+
::::
43
+
44
+
2. Find **Detection rules (SIEM)** in the navigation menu or by using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
45
+
3. Click **Manage value lists**. The **Manage value lists** window opens.
4. Select the list type (**Keywords**, **IP addresses**, **IP ranges**, or **Text**) from the **Type of value list** drop-down.
53
+
5. Drag or select the `csv` or `txt` file that contains the values.
54
+
6. Click **Import value list**.
55
+
56
+
::::{note}
57
+
If you import a file with a name that already exists, a new list is not created. The imported values are added to the existing list instead.
58
+
::::
59
+
60
+
## Manage value lists [manage-value-lists]
61
+
62
+
You can edit, remove, or export existing value lists.
63
+
64
+
### Edit value lists [edit-value-lists]
65
+
66
+
1. Find **Detection rules (SIEM)** in the navigation menu or by using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
67
+
2. Click **Manage value lists**. The **Manage value lists** window opens.
68
+
3. In the **Value lists** table, click the value list you want to edit.
69
+
4. Do any of the following:
70
+
71
+
***Filter items in the list**: Use the KQL search bar to find values in the list. Depending on your list’s type, you can filter by the `keyword`, `ip_range`, `ip`, or `text` fields. For example, to filter by Gmail addresses in a value list of the `keyword` type, enter `keyword:*gmail.com` into the search bar.
72
+
73
+
You can also filter by the `updated_by` field (for example, `updated_by:testuser`), or the `updated at` field (for example, `updated_at < now`).
74
+
75
+
***Add individual items to the list**: Click **Create list item**, enter a value, then click **Add list item**.
76
+
***Bulk upload list items**: Drag or select the `csv` or `txt` file that contains the values that you want to add, then click **Upload**.
77
+
***Edit a value**: In the Value column, go to the value you want to edit and click the **Edit*** button (![Edit button from Manage value lists window](../../../images/security-edit-value-list-item.png"")). When you’re done editing, click the ***Save** button (![Save button from Manage value lists window](../../../images/security-save-value-list-item-changes.png"")) to save your changes. Click the **Cancel** button (![Cancel button from Manage value lists window](../../../images/security-cancel-value-list-item-changes.png"")) to revert your changes.
78
+
***Remove a value**: Click the **Remove value** button (![Remove value list button from Manage value lists window](../../../images/security-remove-value-list-item.png"")) to delete a value from the list.
You can also edit value lists while creating and managing exceptions that use value lists.
88
+
::::
89
+
90
+
### Export or remove value lists [export-remove-value-lists]
91
+
92
+
1. Find **Detection rules (SIEM)** in the navigation menu or by using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
93
+
2. Click **Manage value lists**. The **Manage value lists** window opens.
94
+
3. From the **Value lists** table, you can:
95
+
96
+
1. Click the **Export value list** button (![Export button from Manage value lists window](../../../images/security-export-value-list.png"")) to export the value list.
97
+
2. Click the **Remove value list** button (![Remove button from Manage value lists window](../../../images/security-remove-value-list.png"")) to delete the value list.
0 commit comments