Skip to content

[DOCS] Detection engine wildcard exceptions #2207

@joepeeples

Description

@joepeeples

Description

From PR elastic/kibana#136147 (issue #4237):

Adds support for wildcard exceptions for detection rules. New operators are "matches" and "does not match".

image
image

Wildcard exceptions are evaluated at query time and can be combined with other types of entries such as is, exists, etc. The value of the entry is passed to a wildcard query in the Elasticsearch query, which supports ? and * as wildcard operators. * matches zero or more characters and ? matches any single character.

Wildcard exception entries can only be used on keyword, text, or wildcard fields.

Notes

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions