Question

Excluding Entity from being created

+1

Hi!

We are trying to exclude the MS XDR portal from showing up as a entity in our cases. Tried these 3 variants, but it does not filter it out..

What is the correct formatting? (The entities in cases are urls to incidents, so I need to catch all variants of the URL with a wildcard.

+12

Have you tried type domain in the blocklist?

+1

Have you tried type domain in the blocklist?

I tried changing them to domain, but no avail. The URL shows up as a type DestinationURL in my entities graph.. But that also dosent work.

+1

Bumping this as we still cant seem to exclude these MS XDR URLs from showing up as entities in our cases

+9

Do you know the logsource it is coming from?

Perhaps use a parser extension to null it out?

Sign up