Excluding devices
You can exclude a device across all rules. This is useful in devices that are meant to perform functions that look suspicious out of context.
|
We recommend muting devices rather than excluding tto allow for auditing and to have detections to reference if needed. |
To exclude devices:
- Click the Detections tab.
- In the toolbar, click the gear icon at the right side of the page and select Excluded Devices.
- Click Add New device Range.
- In the Device IP or Range field, enter an IP address or CIDR range.
- Click Add Devices