Creating an Ignore Rule

Procedure

1. To create an ignore rule, go to Detections → Network Detections or Detections → Email Messages, and then click Advanced.
2. Select an attribute and an associated operator.
3. Do one of the following to provide an action:
   • Type a value in the text box.
   • Select a value from the drop-down list.

   Tip Type a keyword to search a partial match.

   Note You can add multiple criteria entries by pressing ENTER after typing a value.

4. (Optional) Click AND or OR to include other criteria sets in the search filter.
5. Click Create Ignore Rule.
   The Create Ignore Rule dialog appears.
6. Type a name for this rule.
7. (Optional) Type a description for this rule.
8. Click Save.
   The ignore rule is created and can be enabled from the Detections → Ignore Rules screen.