Excluding devices
You can exclude a device across all detectors. This is useful in devices that are meant to perform functions that look suspicious out of context.
We recommend muting devices rather than excluding to allow for auditing and to have detections to reference if needed.
To exclude devices:
- Go to Detections > Triage detections. The Detections page opens.
- In the toolbar, click the gear icon at the right side of the page and select Excluded Devices.
- Click Add New device Range.
- In the Device IP or Range field, enter an IP address or CIDR range.
- Click Add Devices