Forum Discussion
New! Extending user based exclusions for alerts
You asked, we listened!
In an effort to improve and enhance your experience using Azure ATP, you can now set alert exclusions that include users, along with other entities such as IP addresses,...
EliOfek
Microsoft
MicrosoftWhen looking at the evidence timestamps (Jan 5) , did they happen after you excluded by the user ?
The timestamp is 1st May.
Yes, they happen after I excluded the user and closed the previous alert.
The content of the new alert changed from "svc-proxy on" to "An actor on".
Yes, they happen after I excluded the user and closed the previous alert.
The content of the new alert changed from "svc-proxy on" to "An actor on".
- EliOfek
DanPan Please open a support case, export the alert data to excel and share with support.
Generally, if you excluded the user account and indeed it was the same user that did this, we should not have reopened this alert.
Note that in some cases we cannot tell who the user is, depending on exact traffic type, so in this case if the machine was not excluded, we will still fire the alert based on the machine.