Create blocklist to exclude entities from alerts

Supported in:

Google SecOps SOAR

You can create a blocklist of items composed of entities that the system does not group alerts by, or entities that shouldn't be displayed in the system.

Add a new blocklist item

1. Navigate to SOAR Settings > Environments > Blocklist.
2. Click on the top right of the page.
3. Enter the Entity Identifier and select the Entity Type, Action, and the Environment.
4. Click Add.

For more information about how how grouped alerts are managed, see Alert grouping mechanism.