-
Notifications
You must be signed in to change notification settings - Fork 206
Closed
Labels
Description
Description
From PR elastic/kibana#136147 (issue #4237):
Adds support for wildcard exceptions for detection rules. New operators are "matches" and "does not match".
Wildcard exceptions are evaluated at query time and can be combined with other types of entries such as is, exists, etc. The value of the entry is passed to a wildcard query in the Elasticsearch query, which supports ? and * as wildcard operators. * matches zero or more characters and ? matches any single character.
Wildcard exception entries can only be used on keyword, text, or wildcard fields.
Notes
- Exception card also has new design, which might affect screenshots. No functional change, just appearance.
- Docs to update:
- We did something similar for Endpoint event filters (step 3c)

