Skip to content

Filter endpoint list exceptions in DE logic#233289

Merged
nkhristinin merged 15 commits intoelastic:mainfrom
nkhristinin:exceptions-remove-de
Oct 8, 2025
Merged

Filter endpoint list exceptions in DE logic#233289
nkhristinin merged 15 commits intoelastic:mainfrom
nkhristinin:exceptions-remove-de

Conversation

@nkhristinin
Copy link
Contributor

@nkhristinin nkhristinin commented Aug 28, 2025 •
edited by kibanamachine
Loading

Summary

Related: https://github.com/elastic/security-team/issues/13777

We are filtering endpoint exceptions from DE execution logic.

Update tests so that endpoint exceptions don't affect alerts generated right now (they should be excluded on the endpoint)

How to test:

Enable FF - endpointExceptionsMovedUnderManagement

  1. Install elastic defender (you can click add elastic defend later at the end) - http://localhost:5601/app/security/administration/endpoints
Screenshot 2025-09-09 at 10 38 13

  1. Now you should have Endpoint Security (Elastic Defend) installed.

  2. Let's create 2 events. You can manipulate user.name to check how exceptions works later.

POST logs-endpoint.alerts-1/_doc
{
  "event.kind": "alert",
  "event.module": "endpoint",
  "event.ingested": "2025-09-09T08:39:55.101Z",
  "@timestamp": "2025-09-09T08:39:55.101Z",
  "user.name": "hello1",
  "host": {
    "os": {
      "name": "windows",           
      "type": "windows"            
    }
  }
}

POST logs-endpoint.alerts-1/_doc
{
  "event.kind": "alert",
  "event.module": "endpoint",
  "event.ingested": "2025-09-09T08:39:55.101Z",
  "@timestamp": "2025-09-09T08:39:55.101Z",
  "user.name": "hello2",
  "host": {
    "os": {
      "name": "windows",           
      "type": "windows"            
    }
  }
}

  1. For the rule, change the interval/schedule if you need to create alerts more easily.

  2. Add endpoint exceptions (windows, and user.name - some value, for example hello1).

Screenshot 2025-09-09 at 11 13 18

--

With FF enabled, we should see 2 alerts generated for user.name hello1 and hello2.

With FF disabled, the exception should work on the DE side, so you only see 1 alert for hello2.
@nkhristinin
Copy link
Contributor Author

nkhristinin commented Aug 28, 2025

/ci
@nkhristinin
Copy link
Contributor Author

nkhristinin commented Sep 8, 2025

/ci
@nkhristinin
Copy link
Contributor Author

nkhristinin commented Sep 8, 2025

/ci
@nkhristinin nkhristinin changed the title Filter endpoint list excpetions Sep 8, 2025
@nkhristinin nkhristinin marked this pull request as ready for review September 8, 2025 13:57
@nkhristinin nkhristinin requested a review from a team as a code owner September 8, 2025 13:57
@nkhristinin nkhristinin requested a review from denar50 September 8, 2025 13:57
@nkhristinin
Copy link
Contributor Author

nkhristinin commented Sep 8, 2025

@elasticmachine merge upstream
@nkhristinin nkhristinin added release_note:deprecation release_note:skip Skip the PR/issue when compiling release notes backport:version Backport to applied version labels v9.2.0 and removed release_note:skip Skip the PR/issue when compiling release notes labels Sep 8, 2025
@nkhristinin nkhristinin marked this pull request as draft September 8, 2025 15:09
@nkhristinin nkhristinin marked this pull request as ready for review September 9, 2025 09:18
@nkhristinin nkhristinin requested a review from a team as a code owner September 9, 2025 09:18
@nkhristinin
Copy link
Contributor Author

nkhristinin commented Sep 10, 2025

@elasticmachine merge upstream
@nkhristinin
Copy link
Contributor Author

nkhristinin commented Sep 15, 2025

@elasticmachine merge upstream
denar50
denar50 approved these changes Sep 16, 2025
View reviewed changes
Copy link
Contributor

@denar50 denar50 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tested it locally and it works as expected. LGTM!
...ons/security/plugins/security_solution/server/lib/detection_engine/rule_types/utils/utils.ts
)
: lists;

if (filteredLists.length > 0) {
Copy link
Contributor

@denar50 denar50 Sep 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: you can do an early return here so the try/catch block is not nested inside the if. It makes the code easier to read.

if (filteredLists.length === 0) {
    return [];
}

try {
...
@nkhristinin
Copy link
Contributor Author

nkhristinin commented Sep 18, 2025

@elasticmachine merge upstream
@nkhristinin
Copy link
Contributor Author

nkhristinin commented Sep 25, 2025

@elasticmachine merge upstream
@nkhristinin nkhristinin enabled auto-merge (squash) September 25, 2025 13:56
@nkhristinin
Copy link
Contributor Author

nkhristinin commented Sep 30, 2025

@elasticmachine merge upstream
@nkhristinin
Copy link
Contributor Author

nkhristinin commented Oct 6, 2025

@elasticmachine merge upstream
@nkhristinin
Copy link
Contributor Author

nkhristinin commented Oct 8, 2025

@elasticmachine merge upstream
@nkhristinin nkhristinin merged commit b1713c3 into elastic:main Oct 8, 2025
12 checks passed
@kibanamachine
Copy link
Contributor

kibanamachine commented Oct 8, 2025

Starting backport for target branches: 9.2

https://github.com/elastic/kibana/actions/runs/18352264525
@elasticmachine
Copy link
Contributor

elasticmachine commented Oct 8, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #41 / discover/group5 discover no data adds a new data view when no data views

Metrics [docs]

✅ unchanged

History
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Oct 8, 2025
@nkhristinin @elasticmachine
Filter endpoint list exceptions in DE logic (elastic#233289)
4f204c2 
## Summary

Related: elastic/security-team#13777

We are filtering endpoint exceptions from DE execution logic.

Update tests so that endpoint exceptions don't affect alerts generated
right now (they should be excluded on the endpoint)

### How to test:

Enable FF - `endpointExceptionsMovedUnderManagement`

1. Install elastic defender (you can click add elastic defend later at
the end) - http://localhost:5601/app/security/administration/endpoints
<img width="1325" height="650" alt="Screenshot 2025-09-09 at 10 38 13"
src="https://github.com/user-attachments/assets/1b642cc8-ec4c-471a-bcd7-5b0086fc2f90"
/>

2. Now you should have `Endpoint Security (Elastic Defend)` installed.

3. Let's create 2 events. You can manipulate user.name to check how
exceptions works later.

```
POST logs-endpoint.alerts-1/_doc
{
  "event.kind": "alert",
  "event.module": "endpoint",
  "event.ingested": "2025-09-09T08:39:55.101Z",
  "@timestamp": "2025-09-09T08:39:55.101Z",
  "user.name": "hello1",
  "host": {
    "os": {
      "name": "windows",
      "type": "windows"
    }
  }
}

POST logs-endpoint.alerts-1/_doc
{
  "event.kind": "alert",
  "event.module": "endpoint",
  "event.ingested": "2025-09-09T08:39:55.101Z",
  "@timestamp": "2025-09-09T08:39:55.101Z",
  "user.name": "hello2",
  "host": {
    "os": {
      "name": "windows",
      "type": "windows"
    }
  }
}
```

4. For the rule, change the interval/schedule if you need to create
alerts more easily.

5. Add endpoint exceptions (windows, and user.name - some value, for
example hello1).

<img width="1455" height="577" alt="Screenshot 2025-09-09 at 11 13 18"
src="https://github.com/user-attachments/assets/ed7e83a2-25bf-4254-8362-5e863ee77e3f"
/>

--

With FF enabled, we should see 2 alerts generated for `user.name`
`hello1` and `hello2`.

With FF disabled, the exception should work on the DE side, so you only
see 1 alert for `hello2`.

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit b1713c3)
@kibanamachine kibanamachine mentioned this pull request Oct 8, 2025
Merged
@kibanamachine
Copy link
Contributor

kibanamachine commented Oct 8, 2025

💚 All backports created successfully

Status Branch Result
✅ 9.2

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation
kibanamachine added a commit that referenced this pull request Oct 8, 2025
@kibanamachine @nkhristinin @elasticmachine
[9.2] Filter endpoint list exceptions in DE logic (#233289) (#238111)
1cc996e 
# Backport

This will backport the following commits from `main` to `9.2`:
- [Filter endpoint list exceptions in DE logic
(#233289)](#233289)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Khristinin
Nikita","email":"nikita.khristinin@elastic.co"},"sourceCommit":{"committedDate":"2025-10-08T17:01:57Z","message":"Filter
endpoint list exceptions in DE logic (#233289)\n\n## Summary\n\nRelated:
https://github.com/elastic/security-team/issues/13777\n\nWe are
filtering endpoint exceptions from DE execution logic.\n\nUpdate tests
so that endpoint exceptions don't affect alerts generated\nright now
(they should be excluded on the endpoint)\n\n\n### How to
test:\n\nEnable FF - `endpointExceptionsMovedUnderManagement`\n\n1.
Install elastic defender (you can click add elastic defend later at\nthe
end) - http://localhost:5601/app/security/administration/endpoints\n<img
width=\"1325\" height=\"650\" alt=\"Screenshot 2025-09-09 at 10 38
13\"\nsrc=\"https://github.com/user-attachments/assets/1b642cc8-ec4c-471a-bcd7-5b0086fc2f90\"\n/>\n\n2.
Now you should have `Endpoint Security (Elastic Defend)`
installed.\n\n3. Let's create 2 events. You can manipulate user.name to
check how\nexceptions works later.\n\n```\nPOST
logs-endpoint.alerts-1/_doc\n{\n \"event.kind\": \"alert\",\n
\"event.module\": \"endpoint\",\n \"event.ingested\":
\"2025-09-09T08:39:55.101Z\",\n \"@timestamp\":
\"2025-09-09T08:39:55.101Z\",\n \"user.name\": \"hello1\",\n \"host\":
{\n \"os\": {\n \"name\": \"windows\", \n \"type\": \"windows\" \n }\n
}\n}\n\nPOST logs-endpoint.alerts-1/_doc\n{\n \"event.kind\":
\"alert\",\n \"event.module\": \"endpoint\",\n \"event.ingested\":
\"2025-09-09T08:39:55.101Z\",\n \"@timestamp\":
\"2025-09-09T08:39:55.101Z\",\n \"user.name\": \"hello2\",\n \"host\":
{\n \"os\": {\n \"name\": \"windows\", \n \"type\": \"windows\" \n }\n
}\n}\n```\n\n4. For the rule, change the interval/schedule if you need
to create\nalerts more easily.\n\n5. Add endpoint exceptions (windows,
and user.name - some value, for\nexample hello1).\n\n<img width=\"1455\"
height=\"577\" alt=\"Screenshot 2025-09-09 at 11 13
18\"\nsrc=\"https://github.com/user-attachments/assets/ed7e83a2-25bf-4254-8362-5e863ee77e3f\"\n/>\n\n\n--\n\nWith
FF enabled, we should see 2 alerts generated for `user.name`\n`hello1`
and `hello2`.\n\nWith FF disabled, the exception should work on the DE
side, so you only\nsee 1 alert for
`hello2`.\n\n---------\n\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"b1713c38ba3e4a7b6e99e6c867868ae39045cae1","branchLabelMapping":{"^v9.3.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:deprecation","backport:version","v9.2.0","v9.3.0"],"title":"Filter
endpoint list exceptions in DE
logic","number":233289,"url":"https://github.com/elastic/kibana/pull/233289","mergeCommit":{"message":"Filter
endpoint list exceptions in DE logic (#233289)\n\n## Summary\n\nRelated:
https://github.com/elastic/security-team/issues/13777\n\nWe are
filtering endpoint exceptions from DE execution logic.\n\nUpdate tests
so that endpoint exceptions don't affect alerts generated\nright now
(they should be excluded on the endpoint)\n\n\n### How to
test:\n\nEnable FF - `endpointExceptionsMovedUnderManagement`\n\n1.
Install elastic defender (you can click add elastic defend later at\nthe
end) - http://localhost:5601/app/security/administration/endpoints\n<img
width=\"1325\" height=\"650\" alt=\"Screenshot 2025-09-09 at 10 38
13\"\nsrc=\"https://github.com/user-attachments/assets/1b642cc8-ec4c-471a-bcd7-5b0086fc2f90\"\n/>\n\n2.
Now you should have `Endpoint Security (Elastic Defend)`
installed.\n\n3. Let's create 2 events. You can manipulate user.name to
check how\nexceptions works later.\n\n```\nPOST
logs-endpoint.alerts-1/_doc\n{\n \"event.kind\": \"alert\",\n
\"event.module\": \"endpoint\",\n \"event.ingested\":
\"2025-09-09T08:39:55.101Z\",\n \"@timestamp\":
\"2025-09-09T08:39:55.101Z\",\n \"user.name\": \"hello1\",\n \"host\":
{\n \"os\": {\n \"name\": \"windows\", \n \"type\": \"windows\" \n }\n
}\n}\n\nPOST logs-endpoint.alerts-1/_doc\n{\n \"event.kind\":
\"alert\",\n \"event.module\": \"endpoint\",\n \"event.ingested\":
\"2025-09-09T08:39:55.101Z\",\n \"@timestamp\":
\"2025-09-09T08:39:55.101Z\",\n \"user.name\": \"hello2\",\n \"host\":
{\n \"os\": {\n \"name\": \"windows\", \n \"type\": \"windows\" \n }\n
}\n}\n```\n\n4. For the rule, change the interval/schedule if you need
to create\nalerts more easily.\n\n5. Add endpoint exceptions (windows,
and user.name - some value, for\nexample hello1).\n\n<img width=\"1455\"
height=\"577\" alt=\"Screenshot 2025-09-09 at 11 13
18\"\nsrc=\"https://github.com/user-attachments/assets/ed7e83a2-25bf-4254-8362-5e863ee77e3f\"\n/>\n\n\n--\n\nWith
FF enabled, we should see 2 alerts generated for `user.name`\n`hello1`
and `hello2`.\n\nWith FF disabled, the exception should work on the DE
side, so you only\nsee 1 alert for
`hello2`.\n\n---------\n\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"b1713c38ba3e4a7b6e99e6c867868ae39045cae1"}},"sourceBranch":"main","suggestedTargetBranches":["9.2"],"targetPullRequestStates":[{"branch":"9.2","label":"v9.2.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.3.0","branchLabelMappingKey":"^v9.3.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/233289","number":233289,"mergeCommit":{"message":"Filter
endpoint list exceptions in DE logic (#233289)\n\n## Summary\n\nRelated:
https://github.com/elastic/security-team/issues/13777\n\nWe are
filtering endpoint exceptions from DE execution logic.\n\nUpdate tests
so that endpoint exceptions don't affect alerts generated\nright now
(they should be excluded on the endpoint)\n\n\n### How to
test:\n\nEnable FF - `endpointExceptionsMovedUnderManagement`\n\n1.
Install elastic defender (you can click add elastic defend later at\nthe
end) - http://localhost:5601/app/security/administration/endpoints\n<img
width=\"1325\" height=\"650\" alt=\"Screenshot 2025-09-09 at 10 38
13\"\nsrc=\"https://github.com/user-attachments/assets/1b642cc8-ec4c-471a-bcd7-5b0086fc2f90\"\n/>\n\n2.
Now you should have `Endpoint Security (Elastic Defend)`
installed.\n\n3. Let's create 2 events. You can manipulate user.name to
check how\nexceptions works later.\n\n```\nPOST
logs-endpoint.alerts-1/_doc\n{\n \"event.kind\": \"alert\",\n
\"event.module\": \"endpoint\",\n \"event.ingested\":
\"2025-09-09T08:39:55.101Z\",\n \"@timestamp\":
\"2025-09-09T08:39:55.101Z\",\n \"user.name\": \"hello1\",\n \"host\":
{\n \"os\": {\n \"name\": \"windows\", \n \"type\": \"windows\" \n }\n
}\n}\n\nPOST logs-endpoint.alerts-1/_doc\n{\n \"event.kind\":
\"alert\",\n \"event.module\": \"endpoint\",\n \"event.ingested\":
\"2025-09-09T08:39:55.101Z\",\n \"@timestamp\":
\"2025-09-09T08:39:55.101Z\",\n \"user.name\": \"hello2\",\n \"host\":
{\n \"os\": {\n \"name\": \"windows\", \n \"type\": \"windows\" \n }\n
}\n}\n```\n\n4. For the rule, change the interval/schedule if you need
to create\nalerts more easily.\n\n5. Add endpoint exceptions (windows,
and user.name - some value, for\nexample hello1).\n\n<img width=\"1455\"
height=\"577\" alt=\"Screenshot 2025-09-09 at 11 13
18\"\nsrc=\"https://github.com/user-attachments/assets/ed7e83a2-25bf-4254-8362-5e863ee77e3f\"\n/>\n\n\n--\n\nWith
FF enabled, we should see 2 alerts generated for `user.name`\n`hello1`
and `hello2`.\n\nWith FF disabled, the exception should work on the DE
side, so you only\nsee 1 alert for
`hello2`.\n\n---------\n\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"b1713c38ba3e4a7b6e99e6c867868ae39045cae1"}}]}]
BACKPORT-->

Co-authored-by: Khristinin Nikita <nikita.khristinin@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
@florent-leborgne
Copy link
Contributor

florent-leborgne commented Oct 14, 2025

Hi! This PR has a release_note:deprecation label. To make sure that this PR is listed in the right place and with useful information for end users, the PR would also ideally have:

  • A team or feature label
  • A ## Release note section in the description that explains the nature of the change

If the change should not be listed in the release notes, please use the release_note:skip label instead.

If this helps, we have a page describing release notes best practices for PRs (Elastic access only)
rylnd pushed a commit to rylnd/kibana that referenced this pull request Oct 17, 2025
@nkhristinin @elasticmachine
Filter endpoint list exceptions in DE logic (elastic#233289)
88b42a6 
## Summary

Related: elastic/security-team#13777

We are filtering endpoint exceptions from DE execution logic.

Update tests so that endpoint exceptions don't affect alerts generated
right now (they should be excluded on the endpoint)


### How to test:

Enable FF - `endpointExceptionsMovedUnderManagement`

1. Install elastic defender (you can click add elastic defend later at
the end) - http://localhost:5601/app/security/administration/endpoints
<img width="1325" height="650" alt="Screenshot 2025-09-09 at 10 38 13"
src="https://github.com/user-attachments/assets/1b642cc8-ec4c-471a-bcd7-5b0086fc2f90"
/>

2. Now you should have `Endpoint Security (Elastic Defend)` installed.

3. Let's create 2 events. You can manipulate user.name to check how
exceptions works later.

```
POST logs-endpoint.alerts-1/_doc
{
  "event.kind": "alert",
  "event.module": "endpoint",
  "event.ingested": "2025-09-09T08:39:55.101Z",
  "@timestamp": "2025-09-09T08:39:55.101Z",
  "user.name": "hello1",
  "host": {
    "os": {
      "name": "windows",           
      "type": "windows"            
    }
  }
}

POST logs-endpoint.alerts-1/_doc
{
  "event.kind": "alert",
  "event.module": "endpoint",
  "event.ingested": "2025-09-09T08:39:55.101Z",
  "@timestamp": "2025-09-09T08:39:55.101Z",
  "user.name": "hello2",
  "host": {
    "os": {
      "name": "windows",           
      "type": "windows"            
    }
  }
}
```

4. For the rule, change the interval/schedule if you need to create
alerts more easily.

5. Add endpoint exceptions (windows, and user.name - some value, for
example hello1).

<img width="1455" height="577" alt="Screenshot 2025-09-09 at 11 13 18"
src="https://github.com/user-attachments/assets/ed7e83a2-25bf-4254-8362-5e863ee77e3f"
/>


--

With FF enabled, we should see 2 alerts generated for `user.name`
`hello1` and `hello2`.

With FF disabled, the exception should work on the DE side, so you only
see 1 alert for `hello2`.

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
NicholasPeretti pushed a commit to NicholasPeretti/kibana that referenced this pull request Oct 27, 2025
@nkhristinin @elasticmachine @NicholasPeretti
Filter endpoint list exceptions in DE logic (elastic#233289)
d396b08 
## Summary

Related: elastic/security-team#13777

We are filtering endpoint exceptions from DE execution logic.

Update tests so that endpoint exceptions don't affect alerts generated
right now (they should be excluded on the endpoint)


### How to test:

Enable FF - `endpointExceptionsMovedUnderManagement`

1. Install elastic defender (you can click add elastic defend later at
the end) - http://localhost:5601/app/security/administration/endpoints
<img width="1325" height="650" alt="Screenshot 2025-09-09 at 10 38 13"
src="https://github.com/user-attachments/assets/1b642cc8-ec4c-471a-bcd7-5b0086fc2f90"
/>

2. Now you should have `Endpoint Security (Elastic Defend)` installed.

3. Let's create 2 events. You can manipulate user.name to check how
exceptions works later.

```
POST logs-endpoint.alerts-1/_doc
{
  "event.kind": "alert",
  "event.module": "endpoint",
  "event.ingested": "2025-09-09T08:39:55.101Z",
  "@timestamp": "2025-09-09T08:39:55.101Z",
  "user.name": "hello1",
  "host": {
    "os": {
      "name": "windows",           
      "type": "windows"            
    }
  }
}

POST logs-endpoint.alerts-1/_doc
{
  "event.kind": "alert",
  "event.module": "endpoint",
  "event.ingested": "2025-09-09T08:39:55.101Z",
  "@timestamp": "2025-09-09T08:39:55.101Z",
  "user.name": "hello2",
  "host": {
    "os": {
      "name": "windows",           
      "type": "windows"            
    }
  }
}
```

4. For the rule, change the interval/schedule if you need to create
alerts more easily.

5. Add endpoint exceptions (windows, and user.name - some value, for
example hello1).

<img width="1455" height="577" alt="Screenshot 2025-09-09 at 11 13 18"
src="https://github.com/user-attachments/assets/ed7e83a2-25bf-4254-8362-5e863ee77e3f"
/>


--

With FF enabled, we should see 2 alerts generated for `user.name`
`hello1` and `hello2`.

With FF disabled, the exception should work on the DE side, so you only
see 1 alert for `hello2`.

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
@dhurley14 dhurley14 mentioned this pull request Nov 12, 2025
Merged
1 task
dhurley14 added a commit that referenced this pull request Nov 24, 2025
@dhurley14
[Security Solution] [Detection Engine] Conditionally hides checkbox t…
98685d9 
…o add endpoint exceptions to rule execution (#242480)

## Summary

Conditionally render endpoint exceptions UI checkbox under "About Rule"
advanced settings.

UI change related to: #233289
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Nov 24, 2025
@dhurley14
[Security Solution] [Detection Engine] Conditionally hides checkbox t…
890406d 
…o add endpoint exceptions to rule execution (elastic#242480)

## Summary

Conditionally render endpoint exceptions UI checkbox under "About Rule"
advanced settings.

UI change related to: elastic#233289

(cherry picked from commit 98685d9)
eokoneyo pushed a commit to eokoneyo/kibana that referenced this pull request Dec 2, 2025
@dhurley14 @eokoneyo
[Security Solution] [Detection Engine] Conditionally hides checkbox t…
4bf8d95 
…o add endpoint exceptions to rule execution (elastic#242480)

## Summary

Conditionally render endpoint exceptions UI checkbox under "About Rule"
advanced settings.

UI change related to: elastic#233289
@florent-leborgne florent-leborgne added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Jan 9, 2026
@elasticmachine
Copy link
Contributor

elasticmachine commented Jan 9, 2026

Pinging @elastic/security-solution (Team: SecuritySolution)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:version Backport to applied version labels release_note:deprecation Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v9.2.0 v9.3.0

5 participants

@nkhristinin @kibanamachine @elasticmachine @florent-leborgne @denar50