Views:
  1. To create an ignore rule, go to Detections > Network Detections or Detections > Email Messages, and then click Advanced.
  2. Select an attribute and an associated operator.
  3. Do one of the following to provide an action:

    • Type a value in the text box.

    • Select a value from the drop-down list.

    Tip:

    Type a keyword to search a partial match.

    Note:

    You can add multiple criteria entries by pressing ENTER after typing a value.

  4. (Optional) Click AND or OR to include other criteria sets in the search filter.
  5. Click Create Ignore Rule.

    The Create Ignore Rule dialog appears.

  6. Type a name for this rule.
  7. (Optional) Type a description for this rule.
  8. Click Save.

    The ignore rule is created and can be enabled from the Detections > Ignore Rules screen.

Parent topic: Ignore Rules Tasks