AnsweredAssumed Answered

ESA Live Rules - Tuning?

Question asked by Jay Watson on Dec 20, 2017
Latest reply on Dec 20, 2017 by Jay Watson

Can the parameters of ESA Live rules be changed? I ask this because I am trying some of the rules from Live and am noticing a high amount of false positives in certain cases and would like to add parameter conditions to exclude items like proxy IPs, etc. Something as simple as ip.addr != 192.168.6.10. I cannot seem to find a away to add or remove any parameters. Does anyone happen to know if these are able to be tuned?

Attachments

Outcomes