Ignoring an IOC (SOAR Action in ServiceNow)

Use the Ignore an IOC SOAR action to ignore an IOC in a specific feed. When it is ignored, the IOC will not trigger Watchlist hits.

• This action can be run from an alert and can be performed on one alert at a time.
• The action can be performed from the related list of the Security Incident table.
• The report is updated by disabling the IOC.