IOC Exclusion for when an IOC was denied by the FW

[PA_nts]

Hi All,

so when an IOC is added for an IP address for example in XSIAM, and a FW logs containing this IP is ingested to XSIAM, then XSIAM will auto create an alert for this IOC regardless if dropped or allowed by the FW.. it detect this IOC and creates an alert. 

has anyone found a solution for IOC not to trigger when the FW action has already dropped this traffic? Exclusion rules does not have a field option for the FW drop action so cannot add an exclusion rule based on the IOC detection method where the FW action was dropped.

any ideas?

thanks in adv