Skip to main content

Threat Detection ManagementThreat Detection Management Guide

Disable Exclusions

Enable an exclusion so it can apply to analytics rules. Disable an exclusion to deactivate it without deleting it.

You can disable an individual exclusion or multiple exclusions at once. Consider disabling multiple exclusions at once to minimize disruptions to other Exabeam applications, analytics engine downtime, and your use of entitled training days.

Disable an Exclusion

Disable an individual exclusion.

  1. Under Exclusions, click View all Exclusions.

    The Threat Detection Management Analytics Rule tab with the View all Exclusions button under Rule Exclusions highlighted in a red rectangle.

  2. For an exclusion, click the More menu The more options menu; three vertical dark grey dots on an off-white background., then select Disable.

Disable Multiple Exclusions

To minimize disruptions to other Exabeam applications, analytics engine downtime, and your use of your entitled training days, disable multiple exclusions at once.

  1. Under Exclusions, click View all Exclusions.

    The Threat Detection Management Analytics Rule tab with the View all Exclusions button under Rule Exclusions highlighted in a red rectangle.

  2. Select the exclusions you're disabling:

    • To select all exclusions, click the checkbox in the header row.

      All exclusions selected.

    • To select specific exclusions, click the checkbox for each exclusion.

      Exclusion A and Exclusion B selected.

  3. Click Disable. The analytics engine restarts and re-trains on past events with the exclusions and temporarily stops processing incoming events.

    The Disable action highlighted in a red rectangle.