diff --git a/docs/cases/cases-ui-integrations.asciidoc b/docs/cases/cases-ui-integrations.asciidoc index 05c65c4e8b..11c84e845a 100644 --- a/docs/cases/cases-ui-integrations.asciidoc +++ b/docs/cases/cases-ui-integrations.asciidoc @@ -221,4 +221,4 @@ To learn how to connect {elastic-sec} to {jira}, check out the following tutoria />
++++ -======= +======= \ No newline at end of file diff --git a/docs/detections/rules-ui-create.asciidoc b/docs/detections/rules-ui-create.asciidoc index b6b1e8b11d..fb10e22137 100644 --- a/docs/detections/rules-ui-create.asciidoc +++ b/docs/detections/rules-ui-create.asciidoc @@ -231,10 +231,14 @@ IMPORTANT: Data in indicator indices must be < "now-30d/d"` searches specified indicator indices for indicators ingested during the past 30 days and rounds the start time down to the nearest day (resolves to UTC `00:00:00`). -.. *Indicator mapping*: Compares the values of the specified event and indicator field -values. When the field values are identical, an alert is generated. To define +.. *Indicator mapping*: Compares the values of the specified event and indicator fields, and generates an alert if the values are identical. ++ +NOTE: Only single-value fields are supported. ++ +To define which field values are compared from the indices add the following: -** *Field*: The field used for comparing values in the {es-sec} event + +** *Field*: The field used for comparing values in the {elastic-sec} event indices. ** *Indicator index field*: The field used for comparing values in the indicator indices.