Whitelisting IOCs

Updated 3 months ago by Elvis Hovor

There are two ways you can add an IOC to your company whitelist:

  • While viewing a report in Constellation view
  • While viewing the details of an IOC in a report or as a standalone IOC.

Whitelisting applies to both the Constellation view and to correlation counts. This feature does not support the use of wildcards or CIDR blocks. ]

Modifications to the whitelist
- affect all users in your organization
- are applied retroactively

Related Link: Managing the Company Whitelist

Whitelisting IOCs in a Report

When viewing a report in Constellation view, the left panel shows a list of extracted indicators. You can click on the eye icon to change the card view for each indicator, then click on the eye for each indicator you want to whitelist.

Whitelisting IOCs from the Detail Panel

When viewing an IOC in the Details panel, you can click on the three-dot menu in the upper right to display the menu and then choose Whitelist on that dropdown menu.

This action is available whenever you are viewing the details of an IOC, either from the Reports Constellation view or the IOC Constellation view.

How Did We Do?