Whitelisting IOCs
There are two ways you can add an IOC to your company whitelist:
- While viewing a report in Constellation view
- While viewing the details of an IOC in a report or as a standalone IOC.
Whitelisting applies to both the Constellation view and to correlation counts. This feature does not support the use of wildcards or CIDR blocks. ]
- affect all users in your organization
- are applied retroactively
Related Link: Managing the Company Whitelist
Whitelisting IOCs in a Report
When viewing a report in Constellation view, the left panel shows a list of extracted indicators. You can click on the eye icon to change the card view for each indicator, then click on the eye for each indicator you want to whitelist.
Whitelisting IOCs from the Detail Panel
When viewing an IOC in the Details panel, you can click on the three-dot menu in the upper right to display the menu and then choose Whitelist on that dropdown menu.
This action is available whenever you are viewing the details of an IOC, either from the Reports Constellation view or the IOC Constellation view.
