Valuelists in EQL (correlation) & Threshold Rules

[tushar.bansal (Tushar)]

Why Can't we add value lists as condition in Correlation Rule Type & Threshold Rule Types even in 7.12? We can only add value lists in indicator match type rules. Why?

[austinsonger]

@tushar.bansal

Why Can't we add value lists as condition in Correlation Rule Type & Threshold Rule Types even in 7.12? We can only add value lists in indicator match type rules. Why?

I don't think so, but you can put a feature request in.

• Issues · elastic/kibana · GitHub

[yctercero (Yara Tercero)]

Hey @tushar.bansal!

Just to piggy back - for more info on why value lists are not supported for EQL and Threshold rules, see this comment . There is an existing enhancement request for adding this functionality. We always encourage users to go in and +1 or add to the conversation to help in prioritizing such requests.