Value Lists as Exception in Threshold and Correlation type rules

Elastic Security SIEM
1

Why Can't we add value list as exception for Threshold rules and correlation rules even in 7.12?

2

Hey there @tushar.bansal :wave:

Please see this comment for why Value Lists can't currently be used with Correlation and Threshold Rules. And here's an enhancement request for adding Value List support to Correlation Rules if you would like to :+1: to better help prioritze.

In the interim, we've updated the documentation to clarify this.

Thanks! :slightly_smiling_face:
Garrett

2 Likes
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.