Does anyone have experience with best practices around either building APP Rules as a "Whitelist" or assigning a List to an APP Rule for whitelisting purposes. We get an abundance of alerts for Powershell for example, well many of these param.src / param.dst statements within the meta or other meta within need to be whitelisted from the rule to stop firing or addressed this at the ESA level. More or less though, historically we have adjusted the meta to by adding && statements. Seems like this is a battle which we are not winning since the lists now get so large. Does anyone have any feedback or similar instances like this?
