Skip to content

Commit

Permalink
[8.8] [BUG] Re-add note about escaping special characters (backport #…
Browse files Browse the repository at this point in the history
…3302) (#3303)

Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>
  • Loading branch information
mergify[bot] and nastasha-solomon authored May 18, 2023
1 parent 8d6ad45 commit 993eb4a
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion docs/detections/add-exceptions.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,9 @@ Fields with conflicts are marked with a warning icon (image:images/field-warning
* Wildcards are not supported in value lists.
* If a value list can't be used due to <<manage-value-lists,size or data type>>, it'll be unavailable in the *Value* menu.
=======
* `matches` | `does not match` — Allows you to use wildcards in *Value*, such as `C:\path\*\app.exe`. Available wildcards are `?` (match one character) and `*` (match zero or more characters). The selected *Field* data type must be {ref}/keyword.html#keyword-field-type[keyword], {ref}/text.html#text-field-type[text], or {ref}/keyword.html#wildcard-field-type[wildcard].
* `matches` | `does not match` — Allows you to use wildcards in *Value*, such as `C:\\path\\*\\app.exe`. Available wildcards are `?` (match one character) and `*` (match zero or more characters). The selected *Field* data type must be {ref}/keyword.html#keyword-field-type[keyword], {ref}/text.html#text-field-type[text], or {ref}/keyword.html#wildcard-field-type[wildcard].
+
NOTE: Some characters must be escaped with a backslash, such as `\\` for a literal backslash, `\*` for an asterisk, and `\?` for a question mark. Windows paths must be divided with double backslashes (for example, `C:\\Windows\\explorer.exe`), and paths that already include double backslashes might require four backslashes for each divider.
+
IMPORTANT: Using wildcards can impact performance. To create a more efficient exception using wildcards, use multiple conditions and make them as specific as possible. For example, adding conditions using `process.name` or `file.name` can help limit the scope of wildcard matching.

Expand Down

0 comments on commit 993eb4a

Please sign in to comment.