Delete and exclude indicators - Administrator Guide - Threat Intel Management Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product
Cortex XSIAM
Creation date
2024-03-06
Last date published
2024-05-15
Category
Administrator Guide
Abstract

Indicators added to an exclusion list are disregarded by the system. Add indicators to an exclusion list in Cortex XSIAM.

Indicators added to an exclusion list are disregarded by the system and are not created or involved in automated flows such as indicator extraction. You can still manually enrich IP addresses and URLs that are on the exclusion list, but the results are not posted to the War Room.

Add indicators to the exclusion list either in the Indicators table or in the Exclusion List page.