Hi,
I have created a watchlist, AWS_IPs and added IP addresses to it. Further, I have created anomaly action rule to reduce the anomaly score by 3 and added AWS_IPs watchlist to it.
But I do not see this AAR getting applied to anomalies that have IP address which are listed in watchlist.
Can anyone please suggest what could the reason behind it and how can I resolve it.
Thanks!
