Valuelists in EQL (correlation) & Threshold Rules

Why Can't we add value lists as condition in Correlation Rule Type & Threshold Rule Types even in 7.12? We can only add value lists in indicator match type rules. Why?

I don't think so, but you can put a feature request in.

Hey @tushar.bansal!

Just to piggy back - for more info on why value lists are not supported for EQL and Threshold rules, see this comment . There is an existing enhancement request for adding this functionality. We always encourage users to go in and +1 or add to the conversation to help in prioritizing such requests.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.