Domains which are excluded are first checked when the Sensor is analyzing the attacks. To exclude a domain, complete the following tasks:
Steps:
Select Analysis → <Admin Domain Name> → Attack Log.
Select the alert whose domain you want to exclude, and click Other Actions.
Select Create Exception and click the Exclusion List Domain: <domain name> option.
A confirmation message is displayed.
In case of callback activity alerts you can exclude the C&C domain by selecting Exclude the C&C Domain.
Click Yes.
The successfully excluded message is displayed.
You can view/edit the excluded domain under Policy → <Admin Domain Name> → Intrusion Prevention → Exceptions → Domain Name Exceptions.
For more information on exclusion list domains, see Add hash values to the allow list.