In 9.3 exception lists will be moved from the SIEM to the endpoint policy per https://github.com/elastic/security-team/issues/14573. For our endpoint promotion rules ...