Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clarifies that expire_time is not available for endpoint exceptions #3856

Merged
merged 3 commits into from
Sep 8, 2023
Merged

Clarifies that expire_time is not available for endpoint exceptions #3856

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
49574fa
Clarifies that expire_time is not available for endpoint exceptions
natasha-moore-elastic Sep 4, 2023
0a60a3b
TW review updates
natasha-moore-elastic Sep 8, 2023
d2f9426
Merge branch 'main' into issue-3294-expire-time
natasha-moore-elastic Sep 8, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/detections/api/exceptions/api-create-exception-item.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ A JSON object with these fields:
exception queries. Boolean `AND` logic is used to evaluate the relationship
between array elements. If you want to use `OR` logic, create a separate
exception item. |Yes
|`expire_time` |String |An expiration date in ISO format. |No
|`expire_time` |String |An expiration date in ISO format. This field is not available for endpoint exceptions. |No
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Users can likely infer that this param only works for regular exceptions, but it might be better to directly state that and remove any potential for ambiguity.

Suggested change
|`expire_time` |String |An expiration date in ISO format. This field is not available for endpoint exceptions. |No
|`expire_time` |String a|Specify when an exception item expires. The expiration date must be in ISO format.
NOTE: This field is only available for regular exception items, not endpoint exceptions. |No

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, @nastasha-solomon! I agree it's better to be explicit in this case – I'll make that change.

For the sake of consistency, I'd slightly tweak your suggestion for the first sentence, since most of the other parameter descriptions start with a noun phrase rather than an imperative verb. How does this sound:

The exception item's expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.

|`list_id` |String |ID of the associated <<exceptions-api-create-container, exception container>>. |Yes
|`item_id` |String |Unique identifier of the exception item. |No, automatically
created when it is not provided.
Expand Down
2 changes: 1 addition & 1 deletion docs/detections/api/exceptions/api-update-exception-item.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ When unspecified, a new comment is created.
exception queries. Boolean `AND` logic is used to evaluate the relationship
between array elements. If you want to use `OR` logic, create a separate
exception item. |Yes
|`expire_time` |String |An expiration date in ISO format. |No
|`expire_time` |String |An expiration date in ISO format. This field is not available for endpoint exceptions. |No
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same comment as above if you decide to accept it.

|`id` |String |The item's unique identifier. |Yes, when the item's `item_id` field is not used.
|`item_id` |String |The `item_id` of the item you are updating. |Yes, when
the item's `id` field is not used.
Expand Down