IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Rule exceptions Add and manage exceptions »
Elastic Docs ›Elastic Security Solution [8.13] ›Detections and alerts ›Rule exceptions

Create and manage value lists

edit

Create and manage value lists

edit

Value lists hold multiple values of the same Elasticsearch data type, such as IP addresses, which are used to determine when an exception prevents an alert from being generated. You can use value lists to define exceptions for detection rules; however, you cannot use value lists to define endpoint rule exceptions.

Value lists are lists of items with the same Elasticsearch data type. You can create value lists with these types:

  • Keywords (many ECS fields are keywords)
  • IP Addresses
  • IP Ranges
  • Text

After creating value lists, you can use is in list and is not in list operators to define exceptions.

You can also use a value list as the indicator match index when creating an indicator match rule.

Create value lists

edit

When you create a value list for a rule exception, be mindful of the list’s size and data type. All rule types support value list exceptions, but extremely large lists or certain data types have limitations.

Custom query, machine learning, and indicator match rules support the following value list types and sizes:

  • Keywords or IP addresses list types with more than 65,536 values
  • IP ranges list type with over 200 dash notation values (for example, 127.0.0.1-127.0.0.4 is one value) or more than 65,536 CIDR notation values

To create a value list:

  1. Prepare a txt or csv file with all the values you want to use for determining exceptions from a single list. If you use a txt file, new lines act as delimiters.

    • All values in the file must be of the same Elasticsearch type.
    • Wildcards are not supported in value lists. Values must be literal values.
    • The maximum accepted file size is 9 million bytes.
  2. Go to Rules → Detection rules (SIEM).

  3. Click Import value lists. The Import value lists window opens.

    Import value lists flyout
  4. Select the list type (Keywords, IP addresses, IP ranges, or Text) from the Type of value list drop-down.
  5. Drag or select the csv or txt file that contains the values.
  6. Click Import value list.

When the name of the file you are importing already exists, the values in the new file are appended to the previously imported values.

Manage value lists

edit

To view, delete, or export existing value lists:

  1. Go to Rules → Detection rules (SIEM).
  2. Click Import value lists. The Import value lists window opens.

  3. In the Value lists table, click the required action button.

    Import value list flyout with action buttons highlighted
« Rule exceptions Add and manage exceptions »