# Elasticsearch Shared Exception Lists **URL:** \ **Category:** Elastic Security\ **Tags:** detection-rules\ **Created:** [January 21, 2025, 1:17pm UTC](https://discuss.elastic.co/t/elasticsearch-shared-exception-lists/373456 "2025-01-21T13:17:22Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![iremtoru](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iremtoru/32/140807_2.png) [@iremtoru](https://discuss.elastic.co/u/iremtoru)\ **Post date:** [January 21, 2025, 1:17pm UTC](https://discuss.elastic.co/t/elasticsearch-shared-exception-lists/373456/1 "2025-01-21T13:17:22Z")
Hello, I created some shared exception lists for some known and legit bots used in user agents and associated it with some of my detection rules but when I checked the results I am still seeing the them. I found the documentation but it is not mentioned whether the shared exception lists are case-sensitive or not? If they are case sensitive, what would be the best approach to include both lowercase and uppercase? Example: BingBot, Bingbot, bingbot Doc ref: [Create and manage shared exception lists | Elastic Security Solution [8.17] | Elastic](https://www.elastic.co/guide/en/security/current/shared-exception-lists.html) ---
**Author:** ![georgii](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/georgii/32/78076_2.png) [@georgii](https://discuss.elastic.co/u/georgii)\ **Post date:** [January 21, 2025, 2:12pm UTC](https://discuss.elastic.co/t/elasticsearch-shared-exception-lists/373456/2 "2025-01-21T14:12:28Z")
Hi @iremtoru, welcome to the forum! Per the [documentation](https://www.elastic.co/guide/en/security/current/add-exceptions.html), rule exceptions are case-sensitive: > Rule exceptions are case-sensitive, which means that any character that’s entered as an uppercase or lowercase letter will be treated as such. One of the workarounds is also mentioned there: > In the event you _don’t_ want a field evaluated as case-sensitive, some ECS fields have a `.caseless` version that you can use. There can be other workarounds, and the best one would depend on your specific use case, needs, and available resources: - Is the list of known and legit bots used in user agents finite and short? Perhaps you could add them all to an exception. If it's just a few items, you could combine them with OR. For more items, you could create a [value list](https://www.elastic.co/guide/en/security/current/value-lists-exceptions.html) and then use `is in list` operator in your exception to match against all of them. - If EQL works well for your use cases, you could create EQL rules and exclude the bots directly in the EQL queries. The EQL's `:` operator is case-insensitive. - If Custom query rules would work for your use cases, then you could create a Kibana [saved query](https://www.elastic.co/guide/en/kibana/current/save-load-delete-query.html) and then attach it to your rules as a filter. More details in the [docs](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-custom-rule). Rule filters are flexible and powerful, as you can use Elasticsearch DSL in them. - If ESQL query rules would work for your use cases, then you could probably use the [`TO_LOWER`](https://www.elastic.co/guide/en/elasticsearch/reference/8.17/esql-functions-operators.html#esql-to_lower) function. - You could leverage runtime fields to normalize the source field values to lowercase, and then match against the runtime field from your exceptions. - You could make the field case-insensitive at the mappings level, especially if it's your custom index and you control the mappings. - Similarly to the above, you could leverage ingest pipelines and the [lowercase processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/lowercase-processor.html). - You could lowercase at ingest time / on the data source side. I'm sure this is not an exhaustive list. Let us know if this helps! ---
**Author:** ![iremtoru](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iremtoru/32/140807_2.png) [@iremtoru](https://discuss.elastic.co/u/iremtoru)\ **Post date:** [January 23, 2025, 2:22pm UTC](https://discuss.elastic.co/t/elasticsearch-shared-exception-lists/373456/3 "2025-01-23T14:22:06Z")
Hello @georgii , So far, in the environment I have ".caseless" version only for process.name and process.executable, not for user agent field. For the case I mentioned, I have a new terms rule that checks for new user agents associated with IP addresses and I added a shared exception list to exclude known bots from user agent field. So, in the list I have ~200 user agents so far. I can try runtime fields to normalize the source field values to lowercase or leveraging ingest pipelines. Thank you so much for the recommendations and explanations, I appreciate it! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 20, 2025, 2:22pm UTC](https://discuss.elastic.co/t/elasticsearch-shared-exception-lists/373456/4 "2025-02-20T14:22:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.