Skip to main content

Threat Detection ManagementThreat Detection Management Guide

Enable Exclusions

Enable exclusions so they are applied to analytics rules. Disable an exclusion to deactivate it without deleting it.

You can enable an individual exclusion or multiple exclusions at once. Consider enabling multiple exclusions at once to minimize disruptions to other Exabeam applications, analytics engine downtime, and your use of entitled training days.

Enable an Exclusion

Enable an individual exclusion.

  1. Under Exclusions, click View all Exclusions.

    The Threat Detection Management Analytics Rule tab with the View all Exclusions button under Rule Exclusions highlighted in a red rectangle.

  2. For an exclusion, click the More menu The more options menu; three vertical dark grey dots on an off-white background., then select Enable.

  3. Click Enable. The analytics engine restarts and retrains analytics rules, which can take up to 10 minutes.

Enable Multiple Exclusions

To minimize disruptions to other Exabeam applications, analytics engine downtime, and your use of your entitled training days, enable multiple exclusions at once.

  1. Under Exclusions, click View all Exclusions.

    The Threat Detection Management Analytics Rule tab with the View all Exclusions button under Rule Exclusions highlighted in a red rectangle.

  2. Select the exclusions you're enabling:

    • To select all exclusions, click the checkbox in the header row.

      All exclusions selected.

    • To select specific exclusions, click the checkbox for each exclusion.

      Exclusion A and Exclusion B selected.

  3. Click Enable.

    The Enable action highlighted in a red rectangle.

  4. Click Enable. The analytics engine restarts and re-trains on past events with the exclusions and temporarily stops processing incoming events.