Can't use exception lists

Elastic Security
1

After adding value lists through API or kibana interface they are not shown in Kibana and can't be added as exception to rules.
If I update rule with exception list using API, it is shown in rule exceptions (but doesn't work) altough I can see it as exception list in kibana showing as not associated with any rule.

I can see value lists and items that I want to use in .items and .lists indices.

Any advice?

1 Like
2

Hey @bolemebrige , What rules did you try to add the exception to? Lists/List exceptions are not supported for EQL rules at the moment.

3

No it's simple query type of rule.

4

Ok, in that case - can you send a screenshot of the list in question as it shows in the UI please? Thanks!

5

https://drive.google.com/file/d/1R-uRfAKbyidFVVBEQpeVDGQQykWAcyXp/view?usp=sharing

Here is a video of actions...

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.