elastic / elastic/detection-rules
[Rule Tuning] Remove Exception List from Endpoint Promotion Rules Post 9.3
Open
Rule: Tuning
Team: TRADE
- Dominant language
- Python
- Stars
- 2.7k
- Forks
- 696
- Avg merge
- 4d 17h
- Merged PRs (30d)
- 87
Description
### Link to Rule
_No response_
### Rule Tuning Type
Data Quality - Ensuring integrity and quality of data used by detection rules.
### Description
In 9.4 exception lists will be moved from the SIEM to the endpoint policy per https://github.com/elastic/security-team/issues/14573 . For our endpoint promotion rules, we need to remove the exception lists.
```python
[[rule.exceptions_list]]
id = "endpoint_list"
list_id = "endpoint_list"
namespace_type = "agnostic"
type = "endpoint"
```
As they will not by evaluated by the SIEM after 9.4.
### Example Data
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.