One week ago I added an artifact (hash) to the allow list. This hash was deteced (reported) by the XDR Agent.
Today, I have a new incident, only related with the same artifact(hash) (different host).
I was expecting of not seing any incident related with this artifact if it is the ONLY related to.
Which is the behaviour then of the Allow List functionality?