# I can't add or edit Shared Exception List

**URL:** <https://discuss.elastic.co/t/i-cant-add-or-edit-shared-exception-list/367063>\
**Category:** Elastic Security\
**Tags:** detection-rules\
**Created:** [September 24, 2024, 3:38pm UTC](https://discuss.elastic.co/t/i-cant-add-or-edit-shared-exception-list/367063 "2024-09-24T15:38:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Matheus\_Marques](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matheus_marques/32/137839_2.png) [@Matheus\_Marques](https://discuss.elastic.co/u/Matheus_Marques)\
**Post date:** [September 24, 2024, 3:38pm UTC](https://discuss.elastic.co/t/i-cant-add-or-edit-shared-exception-list/367063/1 "2024-09-24T15:38:21Z")

</div>

I'm facing problem to edit my shared exception list...

I'd like to edit my rules to add a new SHA256 hash for a new version of my .exe, but this field is locked.

How to solve it?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/d/6de01351e2644778d0071af798924b9283866f2d.png)

---

<div class="post-metadata">

**Author:** ![vitaliidm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitaliidm/32/101610_2.png) [@vitaliidm](https://discuss.elastic.co/u/vitaliidm)\
**Post date:** [October 2, 2024, 11:19am UTC](https://discuss.elastic.co/t/i-cant-add-or-edit-shared-exception-list/367063/2 "2024-10-02T11:19:58Z")

</div>

Hi @Matheus_Marques . Welcome to the community!

What version of Kibana are you using?

This situation likely happened, because indices that queried to display edit form do not contain that field.

What is the name of affected field? Is this issue affect only this one field? Or only this exception? Or is this widespread issue and all exceptions are affected?

Are there any errors in browser network dev tools?  
Fields are retrieved through `internal/data_views/fields` GET request. If it failed, it might be a reason.

Regarding mappings - can you check mappings of default Security solution data view indices?  
Is not available field present there?

> **[Data views in Elastic Security | Elastic Security Solution \[8.15\] | Elastic](https://www.elastic.co/guide/en/security/current/data-views-in-sec.html)**

Querying

```JSON
POST .alerts-security.alerts-default,apm-*-transaction*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,traces-apm*,winlogbeat-*,-*elastic-cloud-logs-*/_field_caps
{ "fields": ["*"]}

```

in [dev tools](https://www.elastic.co/guide/en/kibana/current/devtools-kibana.html) would return all available fields.

Note, `alerts-security.alerts-default,apm-*-transaction*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,traces-apm*,winlogbeat-*,-*elastic-cloud-logs-*` should be replaced with the indices in your default Security Solution Data view

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 30, 2024, 11:20am UTC](https://discuss.elastic.co/t/i-cant-add-or-edit-shared-exception-list/367063/3 "2024-10-30T11:20:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.