How to exclude specific user and tag from an alert?

[tstewartpf]

I've created a GuarDuty finding alert in splunk but I want to exclude any findings from the alert that have specific Value or "tags" associated with regular maintenance scanning. Example would be when I look at the finding from an alert under Event actions I see detail.resource.instanceDetails.tags{}.value and there are some specific values that i have tagged that finding and I would love those not to be reported in the Alert I created.

[woodcock]

See here if using Enterprise Security (there is a feature for that):
https://docs.splunk.com/Documentation/Splunk/latest/Alert/ThrottleAlerts

[gcusello · Accepted solution]

Hi tstewartpf,
could you share your search?
the way to proceed is to modify your search with the tags and users to exclude.
Bye.
Giuseppe

[tstewartpf]

This is my search:

sourcetype="aws:cloudwatch:guardduty" host=serverless

It reports back any GuardDuty activity which is fantastic, but now I want to limit a few activities it reports on... such as activities from known user or known monitoring systems.

[gcusello]

Hi tstewartpf,
At first, insert always in your searches the index so your search is faster!
Then try something like this:

index=my_index sourcetype="aws:cloudwatch:guardduty" host=serverless NOT (user=user1 OR user=user2)
| ...

Bye.
Giuseppe

[tstewartpf]

I forgot to mention if the alert is from a specific user or account I would want to exclude as well.