elastic / elastic/detection-rules

[Rule Tuning] Remove Exception List from Endpoint Promotion Rules Post 9.3

Open
#5,320 2 comments 0 reactions 0 assignees View on GitHub
Rule: Tuning Team: TRADE
Dominant language
Python
Stars
2.7k
Forks
696
Avg merge
4d 17h
Merged PRs (30d)
87

Description

### Link to Rule

_No response_

### Rule Tuning Type

Data Quality - Ensuring integrity and quality of data used by detection rules.

### Description

In 9.4 exception lists will be moved from the SIEM to the endpoint policy per https://github.com/elastic/security-team/issues/14573 . For our endpoint promotion rules, we need to remove the exception lists.

```python
[[rule.exceptions_list]]
id = "endpoint_list"
list_id = "endpoint_list"
namespace_type = "agnostic"
type = "endpoint"
```

As they will not by evaluated by the SIEM after 9.4.

### Example Data

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.