Views:

You can create the following types of exceptions:

Custom exceptions are created in the Detection Model Management app and use target, event source, and match criteria to define the objects and events to be excluded from detections.

Click +Add to create a custom exception.
Context menu exceptions are created from the context menu in Workbench and Observed Attack Techniques and use the detection model filter and match criteria to define the objects and events to be excluded from detections.

Exceptions are not supported for custom models. Objects excluded from normal detection models may still trigger alerts for custom models.

For further assistance, contact Trend Micro Technical Support.

Keywords: liongard, workbench, alert,exclude event,exclude object,false alerts

Excluding object or events from detection model in Trend Vision One

Product / Version includes:

Trend Vision OneAll

Last updated: 2023/06/29

Solution ID: KA-0014454

Category: Configure , Troubleshoot

Summary

To minimize false positives and reduce alert fatigue, you can create exceptions to exclude specified objects and events from detection models.

You can create the following types of exceptions:

Custom exceptions are created in the Detection Model Management app and use target, event source, and match criteria to define the objects and events to be excluded from detections.

Click +Add to create a custom exception.
Context menu exceptions are created from the context menu in Workbench and Observed Attack Techniques and use the detection model filter and match criteria to define the objects and events to be excluded from detections.

Exceptions are not supported for custom models. Objects excluded from normal detection models may still trigger alerts for custom models.

For further assistance, contact Trend Micro Technical Support.

Was this article helpful?