Skip to content

Update add-manage-exceptions.md #2932

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Sep 19, 2025
Merged

Update add-manage-exceptions.md #2932

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1b2e505
Update add-manage-exceptions.md
bsturg Sep 12, 2025
9a8e566
Update solutions/security/detect-and-alert/add-manage-exceptions.md
florent-leborgne Sep 19, 2025
f2191c9
Merge branch 'main' into bsturg-patch-1
florent-leborgne Sep 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 11 additions & 7 deletions solutions/security/detect-and-alert/add-manage-exceptions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,10 @@ You can add exceptions to a rule from the rule details page, the Alerts table, t
When you create a new exception from an alert, exception conditions are auto-populated with relevant alert data. Data from custom highlighted fields is listed first. A comment that describes the auto-generated exception conditions is also added to the **Add comments** section.
::::

::::{note}
When using ES|QL, it is possible to append new fields with commands such as eval. It is NOT possible to apply exceptions to these appended fields. The excpetions are only applied to the index source fields.
* eval - https://www.elastic.co/docs/reference/query-languages/esql/commands/eval
::::

1. **Field**: Select a field to identify the event being filtered.

Expand Down Expand Up @@ -125,9 +129,9 @@ You can add exceptions to a rule from the rule details page, the Alerts table, t
:screenshot:
:::

4. Click **AND** or **OR** to create multiple conditions and define their relationships.
5. Click **Add nested condition** to create conditions using nested fields. This is only required for [these nested fields](#nested-field-list). For all other fields, nested conditions should not be used.
6. Choose to add the exception to a rule or a shared exception list.
5. Click **AND** or **OR** to create multiple conditions and define their relationships.
6. Click **Add nested condition** to create conditions using nested fields. This is only required for [these nested fields](#nested-field-list). For all other fields, nested conditions should not be used.
7. Choose to add the exception to a rule or a shared exception list.

::::{note}
If you are creating an exception from the Shared Exception Lists page, you can add the exception to multiple rules.
Expand All @@ -138,14 +142,14 @@ You can add exceptions to a rule from the rule details page, the Alerts table, t
If a shared exception list doesn’t exist, you can [create one](create-manage-shared-exception-lists.md) from the Shared Exception Lists page.
::::

7. (Optional) Enter a comment describing the exception.
8. (Optional) Enter a future expiration date and time for the exception.
9. Select one of the following alert actions:
8. (Optional) Enter a comment describing the exception.
9. (Optional) Enter a future expiration date and time for the exception.
10. Select one of the following alert actions:

* **Close this alert**: Closes the alert when the exception is added. This option is only available when adding exceptions from the Alerts table.
* **Close all alerts that match this exception and were generated by this rule**: Closes all alerts that match the exception’s conditions and were generated only by the current rule.

10. Click **Add rule exception**.
11. Click **Add rule exception**.


## Add {{elastic-endpoint}} exceptions [endpoint-rule-exceptions]
Expand Down
Loading