Removing an IOA rule from the white list

You can delete a single rule or multiple rules, or all rules at the same time from the white list.

To remove an IOA rule from the white list:

1. In the window of the program web interface, select the IOC Scanner section, IOA White List subsection.

   The table of white-listed IOA rules opens.

2. Select the IOA rule that you want to delete from the white list.

   This opens a window containing information about the IOA rule.

3. Click the Delete button.

   The action confirmation window opens.

4. Click Yes.

The IOA rule is removed from the white list. This rule will be applied during events database scans.

To delete all or several IOA rules from the white list:

1. In the window of the program web interface, select the IOC Scanner section, IOA White List subsection.

   The table of white-listed IOA rules opens.

2. Select the check boxes next to the rules that you want to delete from the white list.

   You can select all rules by selecting the check box in the line containing the headers of columns.

3. In the pane that appears in the lower part of the window, click Delete.

   The action confirmation window opens.

4. Click Yes.

The selected IOA rules will be deleted from the white list. The rules will be applied when scanning the events database.

See also Viewing the IOA rule table Viewing information about an IOA rule Enabling or disabling an IOA rule Adding an IOA rule Editing an IOA rule Deleting an IOA rule Viewing an IOA white list Viewing information about an IOA rule in the white list Adding an IOA rule to the white list Viewing the IOA analysis results Filtering and searching IOA rules Clearing an IOA rules filter

Page top