diff --git a/docs/detections/detections-ui-exceptions.asciidoc b/docs/detections/detections-ui-exceptions.asciidoc index f92e920cfd..1f9645c550 100644 --- a/docs/detections/detections-ui-exceptions.asciidoc +++ b/docs/detections/detections-ui-exceptions.asciidoc @@ -8,11 +8,6 @@ processes and network activity to function without producing unnecessary noise. You can add multiple exceptions to one rule. -IMPORTANT: When you add an exception to the -<> rule, you can select to -add the exception to the Endpoint. When selected, the exception is added to -both the detection rule *and* the Elastic Endpoint agent on your hosts. - In addition to defining exception queries for source event values, you can use rule exceptions with value lists. Value lists are lists of items with the same {es} {ref}/mapping-types.html[data type]. You can create value lists @@ -77,6 +72,8 @@ You can add exceptions to a rule via the rule details page or the Alerts table. When you add an exception, you can also close all alerts that meet the exception's criteria. +IMPORTANT: To ensure an exception is successfully applied, make sure that the fields you've defined for the exception query are correctly and consistently mapped in their respective indices. Refer to {ecs-ref}[ECS] to learn more about supported mappings. + [IMPORTANT] ============== Be careful when adding exceptions to event correlation rules. Exceptions are @@ -159,6 +156,16 @@ with Elastic endpoint rule exceptions. To associate rules, when creating or editing a rule select the <> option. +[IMPORTANT] +===== +When you add an exception to the +<> rule, you can select to +add the exception to the endpoint. When selected, the exception is added to +both the detection rule *and* the {elastic-endpoint} agent on your hosts. + +{ref}/binary.html[Binary fields] are not supported in detection rule exceptions. +===== + [IMPORTANT] ============= Exceptions added to the Elastic Endpoint Security rule affect all alerts sent