In Configuration > Settings > Exclusions, users with the Configuration Manager role can manage the Global Exclusions List, a list of users or accounts excluded from analysis. When a monitoring rule uses the Global Exclusions List, activity from these accounts isn’t included when thresholds are calculated.
Accounts are typically excluded when they:
Enforce ethical walls
Import or process documents
Perform agent or system-administrative functions
Generate activity that differs significantly from normal user behavior
In this section:
Users excluded from future ingestion
You can exclude specific users from future ingestion. This is useful for robot or service accounts that generate very large volumes of audit entries. The feature helps manage ingestion spikes caused by these accounts.
When a user is excluded:
Their audit activity isn't ingested into Threat Manager.
Alerts aren't generated for them.
If they already exist in Threat Manager, they are automatically added to the Global Exclusions List.
NOTE: Earlier Threat Manager deployments used lower ingestion thresholds, which led some environments to exclude many accounts. Re-adding an account resumes ingestion only for new audit events; past events aren’t re-ingested. Keep this list empty unless specific robot or service accounts still cause ingestion issues.
Task: Add or remove a user from future ingestion
In the User ID field, enter a User ID.
Select Add User.
To remove a user, select X Remove next to their name. After removal, the user’s future activity will be ingested again.
Task: Review default exclusions
Earlier Threat Manager deployments may include default exclusions that no longer apply to your environment.
Go to Configuration > Settings > Exclusions.
Check the Users Excluded from Future Ingestion field.
Remove any accounts that don’t apply to your environment or won’t cause high-volume bursts.
Global Exclusions List
The Global Exclusions List contains all accounts excluded from analysis. You can import a list to populate or update it, and export the current list to a file.
Task: Import the Global Exclusions List
Use a text file containing User IDs in double quotes, separated by commas. Maximum file size: 24 MB. When importing, you can choose to merge with the existing list or overwrite it.
Example entry format:
["DAVID", "FIONA", "TA_USER_15", "Jason"]
Under Import Global Exclusions List, select Choose file and upload your list.
Select Overwrite or Merge.
The imported users appear in the Global Exclusions List immediately.
Task: Export the Global Exclusions List
Under Export Global Exclusions List, select Export. Threat Manager generates a TXT file (global_exclusion_list.txt) containing the User IDs in double quotes, separated by commas.
NOTE: Users with the Rule Editor role can also manage exclusions from the Configuration: Exclusions tab.