Skip to content

Commit 7a3d48a

Browse files
Update docs/detections/value-list-exceptions.asciidoc
1 parent 94fc79b commit 7a3d48a

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

docs/detections/value-list-exceptions.asciidoc

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,11 @@ TIP: You can also use a value list as the <<indicator-value-lists,indicator matc
1717
[float]
1818
[[manage-value-lists]]
1919
=== Create value lists
20-
When creating a value list for a rule exception, be mindful of the list's size and data type. In general, all rule types support value list exceptions, but there are some limitations for especially large lists or certain data types. The following limitations only apply to value lists being used for custom query, machine learning, and indicator match rules:
20+
When you create a value list for a rule exception, be mindful of the list's size and data type. All rule types support value list exceptions, but extremely large lists or certain data types have limitations.
21+
22+
Custom query, machine learning, and indicator match rules support the following value list types and sizes:
23+
* **Keywords** or **IP addresses** list types with more than 65,536 values
24+
* **IP ranges** list type with over 200 dash notation values (for example, `127.0.0.1-127.0.0.4` is one value) or more than 65,536 CIDR notation values
2125

2226
* Keyword or IP address lists with more than 65,536 values
2327
* IP range lists with more than 200 dash notation values (for example, `127.0.0.1-127.0.0.4` is one value) or more than 65,536 CIDR notation values

0 commit comments

Comments
 (0)