https://community.splunk.com/t5/Alerting/How-to-exclude-device-from-all-Alerts/m-p/586923#M13530 <P>We utilise Enterprise Security and have a large number of detections that we use.&nbsp; We have recently put in some testing hardware that could trigger any one of these alerts and I am trying to find out if there is someway that we could suppress or exclude a device if that host potentially triggered these rules.&nbsp; Is there a way to effectively do a global "ignore any alerts from xxxx" without having to edit every single rule?</P> Tue, 01 Mar 2022 17:17:32 GMT willadams 2022-03-01T17:17:32Z https://community.splunk.com/t5/Alerting/How-to-exclude-device-from-all-Alerts/m-p/586923#M13530 <P>We utilise Enterprise Security and have a large number of detections that we use.&nbsp; We have recently put in some testing hardware that could trigger any one of these alerts and I am trying to find out if there is someway that we could suppress or exclude a device if that host potentially triggered these rules.&nbsp; Is there a way to effectively do a global "ignore any alerts from xxxx" without having to edit every single rule?</P> Tue, 01 Mar 2022 17:17:32 GMT https://community.splunk.com/t5/Alerting/How-to-exclude-device-from-all-Alerts/m-p/586923#M13530 willadams 2022-03-01T17:17:32Z https://community.splunk.com/t5/Alerting/How-to-exclude-device-from-all-Alerts/m-p/586934#M13531 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/79922">@willadams</a>,</P><P>no, for my knowledge, there isn't any exclusion list in ES, the only way is to customize your correlation searches.</P><P>It could be a good idea to submit this request to Splunk Ideas for the new features of ES.</P><P>Ciao.</P><P>Giuseppe</P> Tue, 01 Mar 2022 07:51:26 GMT https://community.splunk.com/t5/Alerting/How-to-exclude-device-from-all-Alerts/m-p/586934#M13531 gcusello 2022-03-01T07:51:26Z