Skip to main content

Responses are generated using AI and may contain mistakes.

Threat Detection ManagementThreat Detection Management Guide

Create an Exclusion

To exclude events or event field values from triggering an analytics rule, create an exclusion.

To create an exclusion, you define two properties: the conditions events or event field values must match for it to be excluded from triggering an analytics rule; and the scope of the rules to which the exclusion applies.

The conditions events or event field values must match for it to be excluded from triggering an analytics rule are defined in an expression using specific syntax.

You can create a limited number of exclusions, up to:

  • 25 exclusions that apply to all analytics rules

  • 25 exclusions per specific analytics rule family

  • 25 exclusions per specific analytics rule

You can track your progress toward these limits when you create an exclusion.

  1. Ensure there are no pending changes or updates to your analytics rules. If there are pending changes or updates, apply those changes or updates to your environment or delete the changes or updates.

  2. Under Rule Exclusions, click Add.

    The Threat Detection Management Analytics Rules tab showing the Add button under Rule Exclusions highlighted in a red rectangle.

    OR

    In Exclusions, click + New Rule.

    The Exclusions window with the + New Rule button highlighted in a red rectangle.

    OR

    For a specific analytics rule, click the More menu The more options menu; three vertical dark grey dots on an off-white background., then select Exclude.

  3. Enter information about the exclusion:

    • Exclusion Name – Enter the exclusion name.

    • (Optional) Description – Enter details about the purpose or use of the exclusion.

    • Condition – Enter an expression that defines the events or event field values excluded from triggering an analytics rule. Ensure that you use the appropriate syntax.

    • Scope – Define the analytics rules to which the exclusion applies:

      • To exclude events or event field values matching the conditions from triggering any analytics rule, select Global.

        You can create up to 25 exclusions that apply to all analytics rules. View your progress toward this limit under Global exclusions limit.

        The scope of an exclusion with Global selected and the Global exclusions limit highlighted in a red rectangle.

      • To exclude events or event field values matching the conditions from triggering one or more specific analytics rules, select Specify rules. Click the empty field, then from the list, select an analytics rule. To find a specific analytics rule, start typing, then select an analytics rule from the list.

        You can create up to 25 exclusions per specific rule. View your progress toward this limit next to each analytics rule:

        The scope of an exclusion with analytics rules listed and the exclusion limit highlighted in a red rectangle.

      • To exclude events or event field values matching the conditions from triggering one or more analytics rule families, select Specific rule families. Click the empty field, then from the list, select a family. To find a specific analytics rule family, start typing, then select a family from the list.

        You can create up to 25 exclusions per specific analytics rule family. View your progress toward this limit next to each analytics rule family:

        The scope of an exclusion with the specific analytics rule family listed and the exclusion limit highlighted in a red rectangle.

  4. Create the exclusion in enabled or disabled status:

    • If you're creating multiple exclusions, it's best to create them in disabled status and enable them all at once.

      When you enable exclusions, the analytics engine restarts and re-trains on past events with the exclusions and temporarily stops processing incoming events. Enabling multiple exclusions at once minimizes disruptions to other Exabeam applications, analytics engine downtime, and your use of entitled training days.

      To create the exclusion in a disabled state, click Create.

    • To create and enable the exclusion, click Create & Enable. The analytics engine restarts and retrains analytics rules, which can take up to 10 minutes.