Clarifies that `expire_time` is not available for endpoint exceptions #3856

natasha-moore-elastic · 2023-09-04T11:35:57Z

Resolves [BUG] [v8.7] Create exception item API: expire_time #3294

Previews:

github-actions · 2023-09-04T11:36:12Z

Documentation previews:

✨ HTML diff
📙 Elastic Security Guide

nastasha-solomon

Left some minor suggestions, but overall LGTM! Thank you!

nastasha-solomon · 2023-09-05T17:20:43Z

docs/detections/api/exceptions/api-create-exception-item.asciidoc

@@ -43,7 +43,7 @@ A JSON object with these fields:
 exception queries. Boolean `AND` logic is used to evaluate the relationship
 between array elements. If you want to use `OR` logic, create a separate
 exception item. |Yes
-|`expire_time` |String |An expiration date in ISO format. |No
+|`expire_time` |String |An expiration date in ISO format. This field is not available for endpoint exceptions. |No


Users can likely infer that this param only works for regular exceptions, but it might be better to directly state that and remove any potential for ambiguity.

Suggested change

|`expire_time` |String |An expiration date in ISO format. This field is not available for endpoint exceptions. |No

|`expire_time` |String a|Specify when an exception item expires. The expiration date must be in ISO format.

NOTE: This field is only available for regular exception items, not endpoint exceptions. |No

Thanks, @nastasha-solomon! I agree it's better to be explicit in this case – I'll make that change.

For the sake of consistency, I'd slightly tweak your suggestion for the first sentence, since most of the other parameter descriptions start with a noun phrase rather than an imperative verb. How does this sound:

The exception item's expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.

nastasha-solomon · 2023-09-05T17:20:56Z

docs/detections/api/exceptions/api-update-exception-item.asciidoc

@@ -26,7 +26,7 @@ When unspecified, a new comment is created.
 exception queries. Boolean `AND` logic is used to evaluate the relationship
 between array elements. If you want to use `OR` logic, create a separate
 exception item. |Yes
-|`expire_time` |String |An expiration date in ISO format. |No
+|`expire_time` |String |An expiration date in ISO format. This field is not available for endpoint exceptions. |No


Same comment as above if you decide to accept it.

benironside

This LGTM and I like your proposed edit based on Nastasha's comment, @natasha-moore-elastic

…#3856) * Clarifies that expire_time is not available for endpoint exceptions * TW review updates (cherry picked from commit 5182f16)

…#3856) (#3892) * Clarifies that expire_time is not available for endpoint exceptions * TW review updates (cherry picked from commit 5182f16) Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

…#3856) (#3893) * Clarifies that expire_time is not available for endpoint exceptions * TW review updates (cherry picked from commit 5182f16) Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

…#3856) (#3894) * Clarifies that expire_time is not available for endpoint exceptions * TW review updates (cherry picked from commit 5182f16) Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

…#3856) (#3895) * Clarifies that expire_time is not available for endpoint exceptions * TW review updates (cherry picked from commit 5182f16) Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Clarifies that expire_time is not available for endpoint exceptions

49574fa

natasha-moore-elastic added API Feature: Exceptions v8.7.0 v8.8.0 v8.9.0 Team: Detection Engine Priority: Low Issues that need attention, but are not urgent v8.10.0 Effort: Small Issues that can be resolved quickly labels Sep 4, 2023

natasha-moore-elastic self-assigned this Sep 4, 2023

natasha-moore-elastic requested review from dplumlee and a team September 4, 2023 11:54

natasha-moore-elastic marked this pull request as ready for review September 4, 2023 11:54

dplumlee approved these changes Sep 5, 2023

View reviewed changes

nastasha-solomon self-requested a review September 5, 2023 17:13

nastasha-solomon approved these changes Sep 5, 2023

View reviewed changes

benironside approved these changes Sep 8, 2023

View reviewed changes

natasha-moore-elastic and others added 2 commits September 8, 2023 19:02

TW review updates

0a60a3b

Merge branch 'main' into issue-3294-expire-time

d2f9426

natasha-moore-elastic merged commit 5182f16 into main Sep 8, 2023
1 check passed

natasha-moore-elastic deleted the issue-3294-expire-time branch September 8, 2023 18:41

mergify bot pushed a commit that referenced this pull request Sep 8, 2023

Clarifies that expire_time is not available for endpoint exceptions (…

352987b

…#3856) * Clarifies that expire_time is not available for endpoint exceptions * TW review updates (cherry picked from commit 5182f16)

mergify bot pushed a commit that referenced this pull request Sep 8, 2023

Clarifies that expire_time is not available for endpoint exceptions (…

42eb952

…#3856) * Clarifies that expire_time is not available for endpoint exceptions * TW review updates (cherry picked from commit 5182f16)

mergify bot pushed a commit that referenced this pull request Sep 8, 2023

Clarifies that expire_time is not available for endpoint exceptions (…

e4d65c3

…#3856) * Clarifies that expire_time is not available for endpoint exceptions * TW review updates (cherry picked from commit 5182f16)

mergify bot pushed a commit that referenced this pull request Sep 8, 2023

Clarifies that expire_time is not available for endpoint exceptions (…

71186f3

…#3856) * Clarifies that expire_time is not available for endpoint exceptions * TW review updates (cherry picked from commit 5182f16)

mergify bot mentioned this pull request Sep 8, 2023

[8.7] Clarifies that expire_time is not available for endpoint exceptions (backport #3856) #3895

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Clarifies that `expire_time` is not available for endpoint exceptions #3856

Clarifies that `expire_time` is not available for endpoint exceptions #3856

natasha-moore-elastic commented Sep 4, 2023 •

edited

Loading

github-actions bot commented Sep 4, 2023

nastasha-solomon left a comment

nastasha-solomon Sep 5, 2023

natasha-moore-elastic Sep 7, 2023

nastasha-solomon Sep 5, 2023

benironside left a comment

	\|`expire_time` \|String \|An expiration date in ISO format. This field is not available for endpoint exceptions. \|No
	\|`expire_time` \|String a\|Specify when an exception item expires. The expiration date must be in ISO format.
	NOTE: This field is only available for regular exception items, not endpoint exceptions. \|No

Clarifies that expire_time is not available for endpoint exceptions #3856

Clarifies that expire_time is not available for endpoint exceptions #3856

Conversation

natasha-moore-elastic commented Sep 4, 2023 • edited Loading

github-actions bot commented Sep 4, 2023

nastasha-solomon left a comment

Choose a reason for hiding this comment

nastasha-solomon Sep 5, 2023

Choose a reason for hiding this comment

natasha-moore-elastic Sep 7, 2023

Choose a reason for hiding this comment

nastasha-solomon Sep 5, 2023

Choose a reason for hiding this comment

benironside left a comment

Choose a reason for hiding this comment

Clarifies that `expire_time` is not available for endpoint exceptions #3856

Clarifies that `expire_time` is not available for endpoint exceptions #3856

natasha-moore-elastic commented Sep 4, 2023 •

edited

Loading