topic Re: A question from the Alert Tuning Operations Webinar: Alerts & Exclusions in Cortex XDR Discussions

A question from the Alert Tuning Operations Webinar: Alerts & Exclusions

rtsedaka — Wed, 22 Jun 2022 21:00:36 GMT

If I right click on an alert and create an exclusion, does that also only exclude the alert for this specific user-name? Which fields does it use exactly? Where can I see these exclusions afterward?

*Note: This question was submitted during our customer success webinar: Alert Tuning Operation in Cortex XDR

Re: A question from the Alert Tuning Operations Webinar: Alerts & Exclusions

afurze — Wed, 22 Jun 2022 22:05:48 GMT

Hi!

When you click Exclude Alert from the context menu of the Alerts page, this does not create a rule, it is a one time action against one alert. If you want to create or manage exclusion rules, you can go to Incident Response -> Incident Configuration -> Alert Exclusions. Here you can create exclusions and set the parameters to match alerts and exclude.