Whitelisting URLs to Limit False Positive

[Gambit]

Hi all, 

I've just started working with RSA NetWitness, with vulnerabilities alert through the roof (over 60k).

Most of these event are local hosts communicating with various Microsoft IPs.

Can I create a whitelist of such URLs/IPs?  If so how?

Thanks

[KaramveerSingh]

Hi @Gambit 

You can use the context hub lists and use it in your ESA statement with Whitelist condition.

You can refer to below discussion:

https://community.netwitness.com/t5/netwitness-discussions/using-context-hub-lists-for-whitelisting-in-esa-rules/td-p/486807

Regards,

Kv