# Is one of Exceptions

**URL:** <https://discuss.elastic.co/t/is-one-of-exceptions/334992>\
**Category:** Elastic Security\
**Tags:** detection-rules\
**Created:** [June 1, 2023, 2:16pm UTC](https://discuss.elastic.co/t/is-one-of-exceptions/334992 "2023-06-01T14:16:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![emmanuel\_lankford](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emmanuel_lankford/32/121750_2.png) [@emmanuel\_lankford](https://discuss.elastic.co/u/emmanuel_lankford)\
**Post date:** [June 1, 2023, 2:16pm UTC](https://discuss.elastic.co/t/is-one-of-exceptions/334992/1 "2023-06-01T14:16:57Z")

</div>

Just a quick question, for 8.7 it is a little unclear in the documentation if "is one of" allows for wildcarding values or if matches is the only way. If matches is the only way, will there be a more efficient way to add a list of values with wildcards in the future.

---

<div class="post-metadata">

**Author:** ![vitaliidm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitaliidm/32/101610_2.png) [@vitaliidm](https://discuss.elastic.co/u/vitaliidm)\
**Post date:** [June 2, 2023, 4:18pm UTC](https://discuss.elastic.co/t/is-one-of-exceptions/334992/2 "2023-06-02T16:18:10Z")

</div>

Hi @emmanuel_lankford  
Welcome to the Elastic community!

It only supports matching, no wildcards.

I guess it would depend on your workflow.  
"is one of" shows you list of existing value, hence allow to choose which one to ignore.  
"is in list" would allow to apply batch of values in one edit

`matches` | `does not match` supports wildcard though [Add and manage exceptions | Elastic Security Solution [8.8] | Elastic](https://www.elastic.co/guide/en/security/8.8/add-exceptions.html#detection-rule-exceptions)

Thanks, Vitalii

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2023, 4:18pm UTC](https://discuss.elastic.co/t/is-one-of-exceptions/334992/3 "2023-06-30T16:18:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.