Skip to main content
Add a threat to exclusions. The “whitening option” is required. When you create an exclusion, you override the “malicious” verdict of the agent for a detection. This can open holes in your security deployment. We recommend using this action with caution.

​
Parameters

ParameterDescription
Target ScopeScope to be used for restrictions.
Threats IDsList of threats IDs to add to exclusions.
TypeSelected Exclusion type.

​
Example Output

{
	"errors": [
		{
			"type": "object"
		}
	],
	"data": {
		"affected": "integer",
		"details": [
			{
				"analystVerdict": "updated",
				"result": "created",
				"threatId": "225494730938493804"
			}
		]
	}
}

​
Workflow Library Example

Add Threat to Exclusions with Sentinelone and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop