Whitelisting Indicators
Updated 1 year ago
by
TruSTAR
There are two ways you can add an Indicator to your company whitelist:
- While viewing a report in Constellation view
- While viewing the details of an Indicator in a report or as a standalone Indicator.
Whitelisting applies to both the Constellation view and to correlation counts. This feature does not support the use of wildcards or CIDR blocks.
Related Link: Managing the Company Whitelist
Whitelisting from a Report
When viewing a report in Constellation view, the left panel shows a list of extracted Indicators. You can click on the eye icon to change the card view for each indicator, then click on the eye for each Indicator you want to whitelist.
Whitelisting from the Detail Panel
When viewing an Indicator in the Details panel, you can click on the three-dot menu in the upper right to display the menu and then choose Whitelist on that dropdown menu.
This action is available whenever you are viewing the details of an Indicator, either from the Reports Constellation view or the IOC Constellation view.
