Skip to main content

Responses are generated using AI and may contain mistakes.

Threat Detection ManagementThreat Detection Management Guide

Enable Exclusions

Enable exclusions so they are applied to analytics rules. Disable an exclusion to deactivate it without deleting it.

You can enable an individual exclusion or multiple exclusions at once. Consider enabling multiple exclusions at once to minimize disruptions to other Exabeam applications, analytics engine downtime, and your use of entitled training days.

You can enable up to 250 exclusions.

Enable an Exclusion

Enable an individual exclusion.

  1. Ensure there are no pending changes or updates to your analytics rules. If there are pending changes or updates, apply those changes or updates to your environment or delete the changes or updates.

  2. Under Exclusions, click View all Exclusions.

    The Threat Detection Management Analytics Rule tab with the View all Exclusions button under Rule Exclusions highlighted in a red rectangle.

  3. For an exclusion, click the More menu The more options menu; three vertical dark grey dots on an off-white background., then select Enable.

  4. Click Enable. The analytics engine restarts and retrains analytics rules, which can take up to 10 minutes.

Enable Multiple Exclusions

To minimize disruptions to other Exabeam applications, analytics engine downtime, and your use of your entitled training days, enable multiple exclusions at once.

  1. Ensure there are no pending changes or updates to your analytics rules. If there are pending changes or updates, apply those changes or updates to your environment or delete the changes or updates.

  2. Under Exclusions, click View all Exclusions.

    The Threat Detection Management Analytics Rule tab with the View all Exclusions button under Rule Exclusions highlighted in a red rectangle.

  3. Select the exclusions you're enabling:

    • To select all exclusions, click the checkbox in the header row.

      All exclusions selected.

    • To select specific exclusions, click the checkbox for each exclusion.

      Exclusion A and Exclusion B selected.

  4. Click Enable.

    The Enable action highlighted in a red rectangle.

  5. Click Enable. The analytics engine restarts and re-trains on past events with the exclusions and temporarily stops processing incoming events.