Exclude list of dest IP from search using input lookup but correlation is alerting excluded dest IP

[DawoodUlex]

Hi floks,

i have exclude dest IP from search which is working fine but in correlation it is still triggering alert.

search NOT [ | inputlookup sample.csv | fields dest_ip

Thanks

[DawoodUlex]

Thanks David.

Working fine now.

Dawood

[DavidHourani · Accepted solution]

Hi @DawoodUlex,

This could be a permission issue. Go to the search page from enterprise security app and try running your search. It could be that your lookup is not accessible for ES.

If that's the case then all you have to do is move it into ES.

Cheers.
David