diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/exceptionable_endpoint_fields.json b/x-pack/plugins/security_solution/public/common/components/exceptions/exceptionable_endpoint_fields.json
index 043ea11a51fd1..5c483e83a5ae0 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/exceptionable_endpoint_fields.json
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/exceptionable_endpoint_fields.json
@@ -116,6 +116,8 @@
   "user.hash",
   "user.id",
   "Ransomware.feature",
+  "Ransomware.files.data",
+  "Ransomware.child_processes.files.data",
   "Memory_protection.feature",
   "Memory_protection.self_injection",
   "dll.path",