Add domains to Exclusion list

Domains which are excluded are first checked when the Sensor is analyzing the attacks. To exclude a domain, complete the following tasks:

1. Select Analysis → <Admin Domain Name> → Attack Log.
2. Select the alert whose domain you want to exclude, and click Other Actions.
3. Select Create Exception and click the Exclusion List Domain: <domain name> option.
   A confirmation message is displayed.
   In case of callback activity alerts you can exclude the C&C domain by selecting Exclude the C&C Domain.
4. Click Yes.
   The successfully excluded message is displayed.
   You can view/edit the excluded domain under Policy → <Admin Domain Name> → Intrusion Prevention → Exceptions → Domain Name Exceptions.

   For more information on exclusion list domains, see Add hash values to the allow list.