Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[8.8] [Detection Engine][Exceptions] - Update docs for single and shared exceptions (backport #4021) #6454

Merged
merged 1 commit into from
Jan 21, 2025

Conversation

mergify[bot]
Copy link
Contributor

@mergify mergify bot commented Jan 21, 2025

Fixes #3491.

Previews:

  • Elastic Security APIs: Refreshed the description for the Detections API since it technically allows users to manage rule exceptions for individual rules
  • Detections API: Added endpoints for creating a default exception list and creating exception items for a single rule
  • Create a default exception list for a rule: New page that shows how to create an exception list for a single rule (a default exception list)
  • Create exceptions for individual rules: New page that shows how to create exception items that you can add to a default exception list
  • Create exception container | Request body: Added the rule_default value to the type parameter description. Users would enter this value if they wanted the exception container to hold single-rule exception lists (i.e., the default exception list for a rule).
  • Create exceptions used by multiple rules: Made several changes:
    • Updated the title and intro para to show that this endpoint should be used to create exception items that are shared between multiple rules.
    • Added note to the intro that allows users to find docs for creating single rule exception items and exception items created from lists.
    • Fixed or refreshed docs for the following request params: comments, namespace_type, os_types, tags, and list

This is an automatic backport of pull request #4021 done by [Mergify](https://mergify.com).

…ceptions (#4021)

* First draft

* Fixed include

* Update/create exception changes

* Update docs/detections/api/exceptions/api-create-rule-default-exception-list.asciidoc

* Revising intro

* Adding new topic

* Fixing refs

* Removed duplicate entry

* Yara's input

* Minor wording changes

* Title update

* Modifies title for shared exceptions

* Fixing conflicts

* attempt number 2

* Added file ext to index file

* Closing table

* Update docs/detections/api/rules/rules-api-overview.asciidoc

* Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc

* Minor changes and notes

* Fixed route in example

* Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc

* Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc

* Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc

* Remove comment chars

* Input from Yara

* Refreshed params

* minor style fixes

* Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc

* Update docs/detections/api/exceptions/api-create-exception-container.asciidoc

Co-authored-by: Yara Tercero <[email protected]>

* Update docs/detections/api/exceptions/api-update-exception-container.asciidoc

* Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

* Update docs/detections/api/rules/rules-api-create-rule-default-exception-list.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

* Ben's suggestion

* Update docs/detections/api/rules/rules-api-overview.asciidoc

* Update docs/detections/api/rules/rules-api-create-single-rule-exception-item.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

* Replaced container with list

* fixed typo

---------

Co-authored-by: Yara Tercero <[email protected]>
Co-authored-by: Benjamin Ironside Goldstein <[email protected]>
(cherry picked from commit 414527e)
Copy link

A documentation preview will be available soon.

Request a new doc build by commenting
  • Rebuild this PR: run docs-build
  • Rebuild this PR and all Elastic docs: run docs-build rebuild

run docs-build is much faster than run docs-build rebuild. A rebuild should only be needed in rare situations.

If your PR continues to fail for an unknown reason, the doc build pipeline may be broken. Elastic employees can check the pipeline status here.

@nastasha-solomon nastasha-solomon merged commit e46a916 into 8.8 Jan 21, 2025
5 checks passed
@nastasha-solomon nastasha-solomon deleted the mergify/bp/8.8/pr-4021 branch January 21, 2025 18:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant