Tuning policies
At first, some of the incidents reported may not be useful. Use this information to fine- tune policies and rules to better suit the needs of the organization.
To tune a policy based on an incident:
Steps
- Go to the or Discovery page.
- From Recent Reports, select Incidents (last 3 days).
- Select an incident. Its details are displayed in the bottom section of the page.
- Click the Tune Policy button on the left side of the incident details toolbar.
-
Select one of the following options:
- Excluding source from rules
- Disabling policies
- Disabling rules