Skip to main content

Threat Detection ManagementThreat Detection Management Guide

Tune Analytics Rules

To further tune analytics rules, exclude events or event field values from triggering an analytics rule using exclusions.

Exclusions exclude certain analytics rules from triggering on specific event field value or context tables that match conditions you specify; for example, you might want to exclude routine administrative logins from being flagged as suspicious or exclude specific IP ranges commonly used by internal systems from being considered as potential attack vectors. Exclusions can apply to all analytics rules, specific analytics rules, or certain analytic rule families.

To create an exclusion, you define two properties: the conditions events or event field values must match for it to be excluded from triggering an analytics rule; and the scope of the rules to which the exclusion applies. After you create an exclusion, you can edit, enable, disable, and delete it.

View the total number of enabled exclusions under Rule Exclusions:

The Threat Detection Management Analytics Rules tab showing Rule Exclusions highlighted in a red rectangle.

To view all exclusions, click View all Exclusions:

The Threat Detection Management Analytics Rule tab with the View all Exclusions button under Rule Exclusions highlighted in a red rectangle.

For each exclusion, view:

  • Title – The exclusion name and description.

  • Scope – The number of rules to which the exclusion applies. To view the list of rules to which the exclusion applies, hover over the column value.

  • Created by – Who created the exclusion.

  • Created – The date and time the exclusion was created.

  • Last modified – The date and time the exclusion was edited.

  • Status – Whether the exclusion is enabled or disabled.

To view more details about an exclusion, click the More menu The more options menu; three vertical dark grey dots on an off-white background., then select View.