[Detection Engine][Exceptions] - Update docs for single and shared exceptions #4021

nastasha-solomon · 2023-10-09T19:44:13Z

Fixes #3491.

Previews:

Elastic Security APIs: Refreshed the description for the Detections API since it technically allows users to manage rule exceptions for individual rules
Detections API: Added endpoints for creating a default exception list and creating exception items for a single rule
Create a default exception list for a rule: New page that shows how to create an exception list for a single rule (a default exception list)
Create exceptions for individual rules: New page that shows how to create exception items that you can add to a default exception list
Create exception container | Request body: Added the rule_default value to the type parameter description. Users would enter this value if they wanted the exception container to hold single-rule exception lists (i.e., the default exception list for a rule).
Create exceptions used by multiple rules: Made several changes:
- Updated the title and intro para to show that this endpoint should be used to create exception items that are shared between multiple rules.
- Added note to the intro that allows users to find docs for creating single rule exception items and exception items created from lists.
- Fixed or refreshed docs for the following request params: comments, namespace_type, os_types, tags, and list

github-actions · 2023-10-09T19:44:27Z

Documentation previews:

✨ HTML diff
📙 Elastic Security Guide

docs/detections/api/exceptions/api-create-rule-default-exception-list.asciidoc

docs/detections/api/exceptions/api-create-exception-item.asciidoc

docs/detections/api/exceptions/api-create-rule-default-exception-item.asciidoc

docs/detections/api/rules/rules-api-overview.asciidoc

docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc

docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc

nastasha-solomon · 2024-04-03T21:33:32Z

Hey, @yctercero! These docs are ready for your review when you have a chance. As you're reviewing the docs, there are questions for you here about finding rule IDs and here about an example request. I was also hoping you could tell me whether the following endpoints could also be used to manage exception items added to rule default lists:

If they can, I might need to tweak their intros, plus the descriptions for the detections and exception APIs here.

docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc

yctercero · 2024-04-12T16:56:26Z

docs/detections/api/exceptions/api-create-exception-item.asciidoc

-* `process.entity_id`
-* `process.parent.entity_id`
-* `process.ancestry`
+** `file.Ext.quarantine_path`


@caitlinbetz is this still accurate? I know we opened endpoint exceptions up to have less field restrictions, not sure if these still hold.

docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc

docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc

docs/siem-apis.asciidoc

…ceptions (#4021) * First draft * Fixed include * Update/create exception changes * Update docs/detections/api/exceptions/api-create-rule-default-exception-list.asciidoc * Revising intro * Adding new topic * Fixing refs * Removed duplicate entry * Yara's input * Minor wording changes * Title update * Modifies title for shared exceptions * Fixing conflicts * attempt number 2 * Added file ext to index file * Closing table * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Minor changes and notes * Fixed route in example * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Remove comment chars * Input from Yara * Refreshed params * minor style fixes * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/exceptions/api-create-exception-container.asciidoc Co-authored-by: Yara Tercero <[email protected]> * Update docs/detections/api/exceptions/api-update-exception-container.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Ben's suggestion * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Replaced container with list * fixed typo --------- Co-authored-by: Yara Tercero <[email protected]> Co-authored-by: Benjamin Ironside Goldstein <[email protected]> (cherry picked from commit 414527e)

…red exceptions (backport #4021) (#6441) * First draft * Fixed include * Update/create exception changes * Update docs/detections/api/exceptions/api-create-rule-default-exception-list.asciidoc * Revising intro * Adding new topic * Fixing refs * Removed duplicate entry * Yara's input * Minor wording changes * Title update * Modifies title for shared exceptions * Fixing conflicts * attempt number 2 * Added file ext to index file * Closing table * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Minor changes and notes * Fixed route in example * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Remove comment chars * Input from Yara * Refreshed params * minor style fixes * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/exceptions/api-create-exception-container.asciidoc Co-authored-by: Yara Tercero <[email protected]> * Update docs/detections/api/exceptions/api-update-exception-container.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Ben's suggestion * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Replaced container with list * fixed typo --------- Co-authored-by: Yara Tercero <[email protected]> Co-authored-by: Benjamin Ironside Goldstein <[email protected]> (cherry picked from commit 414527e) Co-authored-by: Nastasha Solomon <[email protected]>

…ared exceptions (backport #4021) (#6445) * First draft * Fixed include * Update/create exception changes * Update docs/detections/api/exceptions/api-create-rule-default-exception-list.asciidoc * Revising intro * Adding new topic * Fixing refs * Removed duplicate entry * Yara's input * Minor wording changes * Title update * Modifies title for shared exceptions * Fixing conflicts * attempt number 2 * Added file ext to index file * Closing table * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Minor changes and notes * Fixed route in example * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Remove comment chars * Input from Yara * Refreshed params * minor style fixes * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/exceptions/api-create-exception-container.asciidoc Co-authored-by: Yara Tercero <[email protected]> * Update docs/detections/api/exceptions/api-update-exception-container.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Ben's suggestion * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Replaced container with list * fixed typo --------- Co-authored-by: Yara Tercero <[email protected]> Co-authored-by: Benjamin Ironside Goldstein <[email protected]> (cherry picked from commit 414527e) Co-authored-by: Nastasha Solomon <[email protected]>

…ared exceptions (backport #4021) (#6444) * First draft * Fixed include * Update/create exception changes * Update docs/detections/api/exceptions/api-create-rule-default-exception-list.asciidoc * Revising intro * Adding new topic * Fixing refs * Removed duplicate entry * Yara's input * Minor wording changes * Title update * Modifies title for shared exceptions * Fixing conflicts * attempt number 2 * Added file ext to index file * Closing table * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Minor changes and notes * Fixed route in example * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Remove comment chars * Input from Yara * Refreshed params * minor style fixes * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/exceptions/api-create-exception-container.asciidoc Co-authored-by: Yara Tercero <[email protected]> * Update docs/detections/api/exceptions/api-update-exception-container.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Ben's suggestion * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Replaced container with list * fixed typo --------- Co-authored-by: Yara Tercero <[email protected]> Co-authored-by: Benjamin Ironside Goldstein <[email protected]> (cherry picked from commit 414527e) Co-authored-by: Nastasha Solomon <[email protected]>

…ared exceptions (backport #4021) (#6446) * First draft * Fixed include * Update/create exception changes * Update docs/detections/api/exceptions/api-create-rule-default-exception-list.asciidoc * Revising intro * Adding new topic * Fixing refs * Removed duplicate entry * Yara's input * Minor wording changes * Title update * Modifies title for shared exceptions * Fixing conflicts * attempt number 2 * Added file ext to index file * Closing table * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Minor changes and notes * Fixed route in example * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Remove comment chars * Input from Yara * Refreshed params * minor style fixes * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/exceptions/api-create-exception-container.asciidoc Co-authored-by: Yara Tercero <[email protected]> * Update docs/detections/api/exceptions/api-update-exception-container.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Ben's suggestion * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Replaced container with list * fixed typo --------- Co-authored-by: Yara Tercero <[email protected]> Co-authored-by: Benjamin Ironside Goldstein <[email protected]> (cherry picked from commit 414527e) Co-authored-by: Nastasha Solomon <[email protected]>

…ared exceptions (backport #4021) (#6448) * First draft * Fixed include * Update/create exception changes * Update docs/detections/api/exceptions/api-create-rule-default-exception-list.asciidoc * Revising intro * Adding new topic * Fixing refs * Removed duplicate entry * Yara's input * Minor wording changes * Title update * Modifies title for shared exceptions * Fixing conflicts * attempt number 2 * Added file ext to index file * Closing table * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Minor changes and notes * Fixed route in example * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Remove comment chars * Input from Yara * Refreshed params * minor style fixes * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/exceptions/api-create-exception-container.asciidoc Co-authored-by: Yara Tercero <[email protected]> * Update docs/detections/api/exceptions/api-update-exception-container.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Ben's suggestion * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Replaced container with list * fixed typo --------- Co-authored-by: Yara Tercero <[email protected]> Co-authored-by: Benjamin Ironside Goldstein <[email protected]> (cherry picked from commit 414527e) Co-authored-by: Nastasha Solomon <[email protected]>

…ared exceptions (backport #4021) (#6449) * First draft * Fixed include * Update/create exception changes * Update docs/detections/api/exceptions/api-create-rule-default-exception-list.asciidoc * Revising intro * Adding new topic * Fixing refs * Removed duplicate entry * Yara's input * Minor wording changes * Title update * Modifies title for shared exceptions * Fixing conflicts * attempt number 2 * Added file ext to index file * Closing table * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Minor changes and notes * Fixed route in example * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Remove comment chars * Input from Yara * Refreshed params * minor style fixes * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/exceptions/api-create-exception-container.asciidoc Co-authored-by: Yara Tercero <[email protected]> * Update docs/detections/api/exceptions/api-update-exception-container.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Ben's suggestion * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Replaced container with list * fixed typo --------- Co-authored-by: Yara Tercero <[email protected]> Co-authored-by: Benjamin Ironside Goldstein <[email protected]> (cherry picked from commit 414527e) Co-authored-by: Nastasha Solomon <[email protected]>

…ared exceptions (backport #4021) (#6450) * First draft * Fixed include * Update/create exception changes * Update docs/detections/api/exceptions/api-create-rule-default-exception-list.asciidoc * Revising intro * Adding new topic * Fixing refs * Removed duplicate entry * Yara's input * Minor wording changes * Title update * Modifies title for shared exceptions * Fixing conflicts * attempt number 2 * Added file ext to index file * Closing table * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Minor changes and notes * Fixed route in example * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Remove comment chars * Input from Yara * Refreshed params * minor style fixes * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/exceptions/api-create-exception-container.asciidoc Co-authored-by: Yara Tercero <[email protected]> * Update docs/detections/api/exceptions/api-update-exception-container.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Ben's suggestion * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Replaced container with list * fixed typo --------- Co-authored-by: Yara Tercero <[email protected]> Co-authored-by: Benjamin Ironside Goldstein <[email protected]> (cherry picked from commit 414527e) Co-authored-by: Nastasha Solomon <[email protected]>

…red exceptions (backport #4021) (#6453) * First draft * Fixed include * Update/create exception changes * Update docs/detections/api/exceptions/api-create-rule-default-exception-list.asciidoc * Revising intro * Adding new topic * Fixing refs * Removed duplicate entry * Yara's input * Minor wording changes * Title update * Modifies title for shared exceptions * Fixing conflicts * attempt number 2 * Added file ext to index file * Closing table * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Minor changes and notes * Fixed route in example * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Remove comment chars * Input from Yara * Refreshed params * minor style fixes * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/exceptions/api-create-exception-container.asciidoc Co-authored-by: Yara Tercero <[email protected]> * Update docs/detections/api/exceptions/api-update-exception-container.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Ben's suggestion * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Replaced container with list * fixed typo --------- Co-authored-by: Yara Tercero <[email protected]> Co-authored-by: Benjamin Ironside Goldstein <[email protected]> (cherry picked from commit 414527e) Co-authored-by: Nastasha Solomon <[email protected]>

…red exceptions (backport #4021) (#6454) * First draft * Fixed include * Update/create exception changes * Update docs/detections/api/exceptions/api-create-rule-default-exception-list.asciidoc * Revising intro * Adding new topic * Fixing refs * Removed duplicate entry * Yara's input * Minor wording changes * Title update * Modifies title for shared exceptions * Fixing conflicts * attempt number 2 * Added file ext to index file * Closing table * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Minor changes and notes * Fixed route in example * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Remove comment chars * Input from Yara * Refreshed params * minor style fixes * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/exceptions/api-create-exception-container.asciidoc Co-authored-by: Yara Tercero <[email protected]> * Update docs/detections/api/exceptions/api-update-exception-container.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Ben's suggestion * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Replaced container with list * fixed typo --------- Co-authored-by: Yara Tercero <[email protected]> Co-authored-by: Benjamin Ironside Goldstein <[email protected]> (cherry picked from commit 414527e) Co-authored-by: Nastasha Solomon <[email protected]>

…red exceptions (backport #4021) (#6455) * First draft * Fixed include * Update/create exception changes * Update docs/detections/api/exceptions/api-create-rule-default-exception-list.asciidoc * Revising intro * Adding new topic * Fixing refs * Removed duplicate entry * Yara's input * Minor wording changes * Title update * Modifies title for shared exceptions * Fixing conflicts * attempt number 2 * Added file ext to index file * Closing table * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Minor changes and notes * Fixed route in example * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Remove comment chars * Input from Yara * Refreshed params * minor style fixes * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/exceptions/api-create-exception-container.asciidoc Co-authored-by: Yara Tercero <[email protected]> * Update docs/detections/api/exceptions/api-update-exception-container.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Ben's suggestion * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Replaced container with list * fixed typo --------- Co-authored-by: Yara Tercero <[email protected]> Co-authored-by: Benjamin Ironside Goldstein <[email protected]> (cherry picked from commit 414527e) Co-authored-by: Nastasha Solomon <[email protected]>

…ared exceptions (backport #4021) (#6442) * First draft * Fixed include * Update/create exception changes * Update docs/detections/api/exceptions/api-create-rule-default-exception-list.asciidoc * Revising intro * Adding new topic * Fixing refs * Removed duplicate entry * Yara's input * Minor wording changes * Title update * Modifies title for shared exceptions * Fixing conflicts * attempt number 2 * Added file ext to index file * Closing table * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Minor changes and notes * Fixed route in example * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Remove comment chars * Input from Yara * Refreshed params * minor style fixes * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/exceptions/api-create-exception-container.asciidoc Co-authored-by: Yara Tercero <[email protected]> * Update docs/detections/api/exceptions/api-update-exception-container.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Ben's suggestion * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Replaced container with list * fixed typo --------- Co-authored-by: Yara Tercero <[email protected]> Co-authored-by: Benjamin Ironside Goldstein <[email protected]> (cherry picked from commit 414527e) Co-authored-by: Nastasha Solomon <[email protected]>

…ared exceptions (backport #4021) (#6443) * First draft * Fixed include * Update/create exception changes * Update docs/detections/api/exceptions/api-create-rule-default-exception-list.asciidoc * Revising intro * Adding new topic * Fixing refs * Removed duplicate entry * Yara's input * Minor wording changes * Title update * Modifies title for shared exceptions * Fixing conflicts * attempt number 2 * Added file ext to index file * Closing table * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Minor changes and notes * Fixed route in example * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc * Remove comment chars * Input from Yara * Refreshed params * minor style fixes * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc * Update docs/detections/api/exceptions/api-create-exception-container.asciidoc Co-authored-by: Yara Tercero <[email protected]> * Update docs/detections/api/exceptions/api-update-exception-container.asciidoc * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Ben's suggestion * Update docs/detections/api/rules/rules-api-overview.asciidoc * Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Replaced container with list * fixed typo --------- Co-authored-by: Yara Tercero <[email protected]> Co-authored-by: Benjamin Ironside Goldstein <[email protected]> (cherry picked from commit 414527e) Co-authored-by: Nastasha Solomon <[email protected]>

nastasha-solomon added API Feature: Exceptions v8.7.0 v8.8.0 v8.9.0 v8.10.0 v8.11.0 labels Oct 9, 2023

nastasha-solomon self-assigned this Oct 9, 2023

nastasha-solomon commented Oct 11, 2023

View reviewed changes

docs/detections/api/exceptions/api-create-rule-default-exception-list.asciidoc Outdated Show resolved Hide resolved

nastasha-solomon commented Mar 28, 2024

View reviewed changes

docs/detections/api/exceptions/api-create-exception-item.asciidoc Outdated Show resolved Hide resolved

nastasha-solomon commented Mar 28, 2024

View reviewed changes

docs/detections/api/exceptions/api-create-rule-default-exception-item.asciidoc Outdated Show resolved Hide resolved