Skip to main content
Solved

How do SIEM exclusions work?

  • November 12, 2025
  • 1 reply
  • 43 views
ar3diu
Forum|alt.badge.img+8

Regarding SIEM exclusions in Google SecOps:

  1. Does an exclusion only suppress the creation of an alert (meaning the detection event itself is still created/triggered and visible), or does it prevent the detection event from triggering altogether?
  1. If an exclusion is applied to a specific broad detection rule, will that exclusion also prevent other high-ranking or more precise rules from matching the detection events of the broad rule?

Best answer by kentphelps

I think this might help.  Check out this section in a doc: Tune alerts from rule sets 

It mentions “A rule exclusion specifies criteria that prevent certain events from being evaluated by a rule or rule set” which sounds like the detection event is prevented from triggering.

1 reply

kentphelps
Staff
Forum|alt.badge.img+11
  • kentphelps
  • Staff
  • Answer
  • November 19, 2025

I think this might help.  Check out this section in a doc: Tune alerts from rule sets 

It mentions “A rule exclusion specifies criteria that prevent certain events from being evaluated by a rule or rule set” which sounds like the detection event is prevented from triggering.

ar3diu
Terms & ConditionsCookie settingsAccessibility statement
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.