# Is it possible to use regexp or wildcard when adding exception to detection rules?

**URL:** <https://discuss.elastic.co/t/is-it-possible-to-use-regexp-or-wildcard-when-adding-exception-to-detection-rules/270204>\
**Category:** Elastic Security\
**Created:** [April 15, 2021, 8:52am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-regexp-or-wildcard-when-adding-exception-to-detection-rules/270204 "2021-04-15T08:52:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![buzzdeee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/buzzdeee/32/12703_2.png) [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\
**Post date:** [April 15, 2021, 8:52am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-regexp-or-wildcard-when-adding-exception-to-detection-rules/270204/1 "2021-04-15T08:52:19Z")

</div>

Hi,

when adding exceptions to detection rules, is it possible to use regular expressions or wildcards?

sometimes executable are started in directories created with random names, or have parameters with other variable parts, i.e. /home//some/path/to/file

Is it possible to for example match kind of:  
/home/[a-z]_/some/path/to/file  
or even only  
/home/._/some/path/to/file ?

just want to ensure I don't accidentely miss what I'm looking for.

cheers,  
Sebastian

---

<div class="post-metadata">

**Author:** ![ferullo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ferullo/32/74240_2.png) [@ferullo](https://discuss.elastic.co/u/ferullo)\
**Post date:** [April 15, 2021, 4:35pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-regexp-or-wildcard-when-adding-exception-to-detection-rules/270204/2 "2021-04-15T16:35:27Z")

</div>

Exceptions do not allow wildcarding or regular expressions. Only extract string matching is supported.

---

<div class="post-metadata">

**Author:** ![buzzdeee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/buzzdeee/32/12703_2.png) [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\
**Post date:** [April 15, 2021, 8:22pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-regexp-or-wildcard-when-adding-exception-to-detection-rules/270204/3 "2021-04-15T20:22:02Z")

</div>

thank you @ferullo  
at least I didn't overlooked anything obvious.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 13, 2021, 8:22pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-regexp-or-wildcard-when-adding-exception-to-detection-rules/270204/4 "2021-05-13T20:22:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.