Whitelisting Indicators

Updated 1 year ago by TruSTAR

There are two ways you can add an Indicator to your company whitelist:

  • While viewing a report in Constellation view
  • While viewing the details of an Indicator in a report or as a standalone Indicator.

Whitelisting applies to both the Constellation view and to correlation counts. This feature does not support the use of wildcards or CIDR blocks.

Modifications to the whitelist affect ALL userse in your organization and are applied retroactively to all reports and Indicators stored in your Enclaves.

Related Link: Managing the Company Whitelist

Whitelisting from a Report

When viewing a report in Constellation view, the left panel shows a list of extracted Indicators. You can click on the eye icon to change the card view for each indicator, then click on the eye for each Indicator you want to whitelist.

Whitelisting from the Detail Panel

When viewing an Indicator in the Details panel, you can click on the three-dot menu in the upper right to display the menu and then choose Whitelist on that dropdown menu.

This action is available whenever you are viewing the details of an Indicator, either from the Reports Constellation view or the IOC Constellation view.

How Did We Do?