Add a Core Prevention Process Exclusion from the Alerts Page

You can create Core Prevention exclusions directly from the Alerts page and leverage elements of the alert itself to auto-fill exclusion criteria.

For wildcard usage and syntax guidelines, see Core Prevention Policy Exclusions.

Procedure

1. On the left navigation bar, click Alerts.
2. Select an alert that was generated from a Core Prevention category.
3. Click the icon at the right of the alert.
   In the Alert Details section, you can view the Rule that initiated the alert.

   

4. Scroll down to the Remediation section and click the Add button for Add exclusion.

   

5. Identify the attributes to include in the exclusion. After checking the attribute boxes, the metadata from each attribute automatically fills into the exclusion creation window. You can then add or modify attributes.

   

6. Click Next.
7. Review your exclusion selection and click Save.