---
title: Create and manage shared exception lists
description: Create and manage shared exception lists to apply the same exceptions to multiple rules.
url: https://www.elastic.co/elastic/docs-builder/docs/3016/solutions/security/detect-and-alert/create-manage-shared-exception-lists
products:
- Elastic Cloud Serverless
- Elastic Security
applies_to:
- Serverless Security projects: Generally available
- Elastic Stack: Generally available
---
# Create and manage shared exception lists
Shared exception lists let you group exception items and apply them to multiple rules at once. Instead of adding the same exception to each rule individually, create a shared list and associate it with any rules that need it.
## Create a shared exception list
1. Find the **Shared exception lists** page in the navigation menu or by using the [global search field](https://www.elastic.co/elastic/docs-builder/docs/3016/explore-analyze/find-and-organize/find-apps-and-objects).
2. Click **Create shared exception list** > **Create shared list**.
3. Give the shared exception list a name.
4. (Optional) Provide a description.
5. Click **Create shared exception list**.
## Add exception items
After creating a shared exception list, add exception items to it:
1. Find the **Shared exception lists** page in the navigation menu or by using the [global search field](https://www.elastic.co/elastic/docs-builder/docs/3016/explore-analyze/find-and-organize/find-apps-and-objects).
2. Click **Create shared exception list** > **Create exception item**.
You can also add exceptions to an empty shared exception list by expanding the list or viewing its details page and clicking **Create rule exception**.
3. In the **Add rule exception** flyout, name the exception item and add conditions that define when the exception prevents alerts. For details on configuring conditions, operators, and values, refer to [Configure exception conditions](/elastic/docs-builder/docs/3016/solutions/security/detect-and-alert/add-manage-exceptions#detection-rule-exceptions).
4. Click **AND** or **OR** to create multiple conditions and define their relationships.
5. Click **Add nested condition** to create conditions using nested fields. This is only required for [these nested fields](/elastic/docs-builder/docs/3016/solutions/security/detect-and-alert/add-manage-exceptions#nested-field-list). For all other fields, nested conditions should not be used.
6. Choose one or more shared exception lists to add the exception to.
This option is unavailable if no shared exception list exists. You also can't add an endpoint exception item to the Endpoint Security Exception List from this UI. Refer to [Add Elastic Endpoint exceptions](/elastic/docs-builder/docs/3016/solutions/security/detect-and-alert/add-manage-exceptions#endpoint-rule-exceptions) for instructions.
7. (Optional) Enter a comment describing the exception.
8. (Optional) Enter a future expiration date and time for the exception.
9. (Optional) Select **Close all alerts that match this exception and were generated by this rule** to close matching alerts.
10. Click **Add rule exception**.
## Associate shared exception lists with rules
After creating a shared exception list, associate it with the rules that should use it:
1. Find the **Shared exception lists** page in the navigation menu or by using the [global search field](https://www.elastic.co/elastic/docs-builder/docs/3016/explore-analyze/find-and-organize/find-apps-and-objects).
2. Do one of the following:
- Click a shared exception list's name to open its details page, then click **Link rules**.
- Find the shared exception list, then from the **More actions** menu `boxes_horizontal`, select **Link rules**.
3. Click the toggles in the **Link** column to select the rules you want to link.
If you know a rule's name, enter it into the search bar.
4. Click **Save**.
5. (Optional) To verify the association:
1. Open a rule's details page (**Rules > Detection rules (SIEM) > Rule name**).
2. Scroll down and select the **Rule exceptions** tab.
3. Navigate to the exception items from the shared list. Click the **Affects shared list** link to view the associated shared exception lists.
## View and filter exception lists
The Shared Exception Lists page displays each list on an individual row, with the most recently created list at the top. Each row shows:
- List name
- Date created
- Username of the creator
- Number of exception items
- Number of rules linked to the list
To view the details of an exception item, expand a row.
To filter exception lists by a specific value, enter a value in the search bar. You can search the following attributes:
- `name`
- `list_id`
- `created_by`
If no attribute is selected, the app searches the list name by default.
## Manage shared exception lists
From the Shared Exception Lists page, you can edit, export, import, duplicate, and delete shared exception lists.
To export or delete an exception list, select the required action button on the appropriate list. Note the following:
- Exception lists are exported to `.ndjson` files.
- Exception lists are also exported as part of any exported detection rules configured with exceptions. Refer to [Export and import rules](/elastic/docs-builder/docs/3016/solutions/security/detect-and-alert/manage-detection-rules#import-export-rules-ui).
- If an exception list is linked to any rules, you'll get a warning asking you to confirm the deletion.
- If an exception list contains expired exceptions, you can choose whether to include them in the exported file.
