[Yandex Cloud documentation](../../../index.md) > [Yandex SIEM](../../index.md) > [Step-by-step guides](../index.md) > [Exceptions](index.md) > Managing exceptions

# Managing exceptions

{% note info %}

This feature is in the [Preview](../../../overview/concepts/launch-stages.md) stage. To get access, contact [tech support](https://center.yandex.cloud/support) or your account manager.

{% endnote %}

This section describes how to create exceptions, manage their settings, and perform basic operations with them.

## Getting started {#before-you-begin}

The Yandex SIEM section will appear in the Cloud Center interface as a Security Deck module after the access request is approved.

You need the `ycem.editor` [role](../../../iam/roles-reference.md#ycdr-admin) to use the service.

## Creating an exception from a correlation rule {#create-from-rule}

To create an exception from a correlation rule:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select **Yandex SIEM**.
  1. Navigate to **Correlation rules**.
  1. In the rule's row, click ![image](../../../_assets/console-icons/ellipsis.svg) and select **Create exception**.
  1. Under **Conditions**, add one or more `key = value` pairs for events that should not trigger the rule.
  1. Under **Parameters**, fill in the required **Name** field, and, optionally, the **Description** field.
  1. Click **Save**.

  The associated rule will be filled in automatically.

{% endlist %}

## Creating an exception from the exceptions section {#create-from-exceptions}

To create an exception from the exceptions section:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select **Yandex SIEM**.
  1. Navigate to **Exceptions**.
  1. Click **New exception**.
  1. From the list that opens, select the correlation rule you are creating the exception for.
  1. Under **Conditions**, add one or more `key = value` pairs that define events which should not trigger the rule.
  1. Under **Parameters**, fill in the required **Name** field, and, optionally, the **Description** field.
  1. Click **Save**.

{% endlist %}

## Editing an exception {#edit}

To edit exception settings:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select **Yandex SIEM**.
  1. Navigate to **Exceptions**.
  1. In the exception row, click ![image](../../../_assets/console-icons/ellipsis.svg) and select **Edit**.
  1. Edit the fields as needed.
  1. Click **Save**.

{% endlist %}

## Disabling an exception {#disable}

To disable an exception:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select **Yandex SIEM**.
  1. Navigate to **Exceptions**.
  1. In the exception row, click ![image](../../../_assets/console-icons/ellipsis.svg) and select **Disable**.

  A disabled exception changes its status to **Inactive** and will no longer apply when processing events.

{% endlist %}

## Resetting changes {#reset}

To reset the changes you made to the exception to the last deployed version:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select **Yandex SIEM**.
  1. Navigate to **Exceptions**.
  1. In the exception row, click ![image](../../../_assets/console-icons/ellipsis.svg) and select **Reset changes**.

  All unsaved changed will be canceled. The exception will reset to the last deployed configuration.

{% endlist %}

## Deleting an exception {#delete}

To delete an exception:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select **Yandex SIEM**.
  1. Navigate to **Exceptions**.
  1. In the exception row, click ![image](../../../_assets/console-icons/ellipsis.svg) and select **Delete**.
  1. Confirm the deletion.

  {% note warning %}

  Exception deletion is irreversible. All exception settings will be cleared.

  {% endnote %}

{% endlist %}

#### Useful links {#see-also}

* [Correlation rules and exceptions](../../concepts/correlation-rules.md)
* [Managing correlation rules](../correlation-rules/manage-rules.md)
* [Working with a list of exceptions](exceptions-list.md)