Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[7.17] [ESS][Pt. Duex] Adding value list file size constraints to UI docs (backport #5001) #5251

Merged
merged 4 commits into from
May 29, 2024

Conversation

mergify[bot]
Copy link
Contributor

@mergify mergify bot commented May 20, 2024

…5001)

* First draft

* Input from Yara

* Update docs/detections/value-list-exceptions.asciidoc

* Update docs/detections/value-list-exceptions.asciidoc

* Remove duplicated content

(cherry picked from commit 2e9f4b1)

# Conflicts:
#	docs/detections/value-list-exceptions.asciidoc
Copy link
Contributor Author

mergify bot commented May 20, 2024

Cherry-pick of 2e9f4b1 has failed:

On branch mergify/bp/7.17/pr-5001
Your branch is up to date with 'origin/7.17'.

You are currently cherry-picking commit 2e9f4b14.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Unmerged paths:
  (use "git add/rm <file>..." as appropriate to mark resolution)
	deleted by us:   docs/detections/value-list-exceptions.asciidoc

no changes added to commit (use "git add" and/or "git commit -a")

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

Copy link

A documentation preview will be available soon.

Request a new doc build by commenting
  • Rebuild this PR: run docs-build
  • Rebuild this PR and all Elastic docs: run docs-build rebuild

run docs-build is much faster than run docs-build rebuild. A rebuild should only be needed in rare situations.

If your PR continues to fail for an unknown reason, the doc build pipeline may be broken. Elastic employees can check the pipeline status here.

@nastasha-solomon
Copy link
Contributor

@yctercero I checked the 7.17 value list docs, and didn't find info on list size limits.

Is the following information still applicable to value lists that are created in 7.x or does it only apply to 8.x? If it doesn't apply to 7.x, I'll close this PR since it's no longer necessary.

When you create a value list for a rule exception, be mindful of the list's size and data type. All rule types support value list exceptions, but extremely large lists or certain data types have limitations.

Custom query, machine learning, and indicator match rules support the following value list types and sizes:

  • Keywords or IP addresses list types with more than 65,536 values
  • IP ranges list type with over 200 dash notation values (for example, 127.0.0.1-127.0.0.4 is one value) or more than 65,536 CIDR notation values

@yctercero
Copy link
Contributor

@nastasha-solomon let me know if I can help with this one. Happy to quickly hop on a zoom to determine the changes needed.

Removing page that shouldn't be in the 7.17 docs
This reverts commit 07139c7.
Removing page that shouldn't be added to 7.17 and updating 7.17 value list docs
@nastasha-solomon
Copy link
Contributor

@yctercero and @e40pud the updated docs are ready for review here. Step one already lists the supported file types, so I just added the file size limit to the note under it.

Copy link
Contributor

@yctercero yctercero left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@nastasha-solomon nastasha-solomon merged commit 825016d into 7.17 May 29, 2024
3 checks passed
@nastasha-solomon nastasha-solomon deleted the mergify/bp/7.17/pr-5001 branch May 29, 2024 03:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants