Excluding devices

You can exclude a device across all rules. This is useful in devices that are meant to perform functions that look suspicious out of context.

We recommend muting devices rather than excluding tto allow for auditing and to have detections to reference if needed.

To exclude devices:

1. Click the Detections tab.
2. In the toolbar, click the gear icon at the right side of the page and select Excluded Devices.

   

3. Click Add New device Range.
4. In the Device IP or Range field, enter an IP address or CIDR range.
5. Click Add Devices