Detection Model Management Exceptions endpointIp Field supports IP Address Range Values (ex. 10.205.100.0/24)
If the Workbench Alerts persists, navigate to the Workbench Alert and click "View Event"
This will show the Observed Attack Techniques App Event which triggered the Workbench Alert.
From Observed Attack Techniques App, ensure that the endpointIp value falls within the defined IP Address Range of the Detection Model Management Exception Values.
Trend Vision OneAll
A customer configured Detection Model Managment Exception for a Workbench Alert
XDR Threat Investigation > Detection Model Management > Exceptions Tab
Under Targets, Field used was EndpointIp and for Values the customer specified IP address Range (ex. 10.205.100.0/24).
However, the Workbench Alert still persists and the Exception doesn't seem to match.
Detection Model Management Exceptions endpointIp Field supports IP Address Range Values (ex. 10.205.100.0/24)
If the Workbench Alerts persists, navigate to the Workbench Alert and click "View Event"
This will show the Observed Attack Techniques App Event which triggered the Workbench Alert.
From Observed Attack Techniques App, ensure that the endpointIp value falls within the defined IP Address Range of the Detection Model Management Exception Values.
