Views:

Set exclusions to prevent specific response actions from affecting groups of selected endpoints.

For some critical devices, exclusions from certain response actions may be necessary to keep traffic flowing or important processes running. Response action exclusions for an endpoint or group of endpoints apply no matter where in the Trend Vision One console a response action is triggered.

Procedure

  1. Go to Workflow and Automation → Response Management and click the Settings tab.
  2. Enable Exclude specified endpoints from response actions and click Edit settings.
    Note
    Note
    If you see View settings, you lack the necessary permissions to edit the settings.
  3. Choose a response action for exclusion from the drop-down menu.
  4. Click the edit (modify_connector=d7163417-a1d8-4a5a-8e4b-a8babe128751.jpg) icon under Excluded endpoints to select endpoints to exclude from the action.
    1. Select individual endpoints or all endpoints from the list of available endpoints.
      The endpoints move to the Selected Endpoints tab.
    2. Click Save to save the selected endpoints as a group of excluded endpoints.
      Note
      Note
      You may select a maximum of 2000 endpoints per exclusion.
  5. To copy the group of endpoints to a new response action exclusion, click the copy (duplicate=e79af1b6-17af-40ad-b942-53ffb9e796d2.jpg) icon and choose a new response action.
  6. To add a new exclusion with a new group of excluded endpoints, click Add Exclusion.
    Note
    Note
    You may add up to 6 exclusions.
  7. Choose whether to activate the exclusions after saving the setting configuration.
  8. Click Save to save and return to Response Management settings.