# Valuelists in EQL (correlation) & Threshold Rules

**URL:** <https://discuss.elastic.co/t/valuelists-in-eql-correlation-threshold-rules/268355>\
**Category:** SIEM\
**Created:** [March 25, 2021, 1:41pm UTC](https://discuss.elastic.co/t/valuelists-in-eql-correlation-threshold-rules/268355 "2021-03-25T13:41:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tushar.bansal](https://avatars.discourse-cdn.com/v4/letter/t/e495f1/32.png) [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\
**Post date:** [March 25, 2021, 1:41pm UTC](https://discuss.elastic.co/t/valuelists-in-eql-correlation-threshold-rules/268355/1 "2021-03-25T13:41:51Z")

</div>

Why Can't we add value lists as condition in Correlation Rule Type & Threshold Rule Types even in 7.12? We can only add value lists in indicator match type rules. Why?

---

<div class="post-metadata">

**Author:** ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)\
**Post date:** [March 29, 2021, 9:26pm UTC](https://discuss.elastic.co/t/valuelists-in-eql-correlation-threshold-rules/268355/2 "2021-03-29T21:26:09Z")

</div>

> [@tushar.bansal](#):
>
> Why Can't we add value lists as condition in Correlation Rule Type & Threshold Rule Types even in 7.12? We can only add value lists in indicator match type rules. Why?

I don't think so, but you can put a feature request in.

- [Issues · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues)

---

<div class="post-metadata">

**Author:** ![yctercero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yctercero/32/68560_2.png) [@yctercero](https://discuss.elastic.co/u/yctercero)\
**Post date:** [April 15, 2021, 4:31pm UTC](https://discuss.elastic.co/t/valuelists-in-eql-correlation-threshold-rules/268355/3 "2021-04-15T16:31:25Z")

</div>

Hey @tushar.bansal!

Just to piggy back - for more info on why value lists are not supported for EQL and Threshold rules, see [this comment](https://github.com/elastic/kibana/issues/84385#issuecomment-784718379). There is an existing [enhancement request](https://github.com/elastic/kibana/issues/92347) for adding this functionality. We always encourage users to go in and +1 or add to the conversation to help in prioritizing such requests.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 13, 2021, 4:31pm UTC](https://discuss.elastic.co/t/valuelists-in-eql-correlation-threshold-rules/268355/4 "2021-05-13T16:31:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.