Skip to content

Commit 7bfccc4

Browse files
[8.0] [Redo][7.17-8.5] Highlight that rule exceptions are case-sensitive (#4806) (#4920)
# Conflicts: # docs/detections/detections-ui-exceptions.asciidoc
1 parent 172d3a7 commit 7bfccc4

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

docs/detections/detections-ui-exceptions.asciidoc

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,8 @@ the exception prevents the rule from generating alerts when the
122122
+
123123
[IMPORTANT]
124124
============
125+
* Rule exceptions are case-sensitive, which means that any character that's entered as an uppercase or lowercase letter will be treated as such. In the event you _don't_ want a field evaluated as case-sensitive, some ECS fields have a `.caseless` version that you can use.
126+
125127
* You can use nested conditions. However, this is only required for
126128
<<nested-field-list, these fields>>. For all other fields, nested conditions
127129
should not be used.
@@ -196,6 +198,8 @@ image::images/endpoint-add-exp.png[]
196198
. If required, modify the conditions.
197199
+
198200
NOTE: See <<ex-nested-conditions>> for more information on when nested conditions are required.
201+
+
202+
IMPORTANT: Rule exceptions are case-sensitive, which means that any character that's entered as an uppercase or lowercase letter will be treated as such. In the event you _don't_ want a field evaluated as case-sensitive, some ECS fields have a `.caseless` version that you can use.
199203

200204
. You can select any of the following:
201205

@@ -300,4 +304,3 @@ To export or delete an exception list, select the required action button on the
300304

301305
[role="screenshot"]
302306
image::images/actions-exception-list.png[Detail of Exceptions table with export and delete buttons highlighted,400]
303-

0 commit comments

Comments
 (0)