Event banner
Event details
Are you going to have a workflow for MDI exclusions? Such as, SOC Analyst gives a verdict that an alert is false positive and suggests exclusion , it goes to a group of security engineer who analyses the overall impact and decides on exclusion or not?
Currently, Incidents are meant to be assigned to one or more people so they can reach a conclusion. You can use a similar approach to reach a conclusion with regards to exclusions too.