> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/alerts/alert-exclusions.md). # Alert exclusions Through the process of remediating alerts, you may determine that a specific type of alert does not indicate a threat. If you do not want Cortex Xpanse to reopen or create alerts that match certain criteria, you can create an alert exclusion rule. After you create an exclusion rule, Cortex Xpanse will not create alerts when the alert match criteria are met. If you choose to apply the rule to historic results in addition to future alerts, historic alerts are grayed out in the UI. {% hint style="info" %} ### Note If an incident contains only historic alerts with exclusions, Cortex Xpanse changes the incident status to `Resolved` and sends an email notification to the incident assignee (if set). {% endhint %} ## **Create an alert exclusion rule** 1. Go to **Rules** → **Alert Exclusions**. 2. Select **+ Add Alert Exclusion Rule**. 3. Enter a **Rule Name** to identify the exclusion policy. 4. (Optional) Enter any comments to explain the purpose the rule or provide additional context. 5. Define the exclusion criteria. * Use either the filters at the top of the table to build your exclusion criteria. * Use existing alert values to populate your exclusion criteria. To do so, right-click the column value on which you want to base your rule and select **Add alerts with \ to configuration**. As you define the criteria, the table is filtered to display matching alerts. 6. Review the results. The alerts in the table will be grayed out and Cortex Xpanse will note create new alerts matching the criteria.

Caution

This action is irreversible: All historically excluded alerts will remain excluded if you disable or delete the policy.

7. **Create** and then select **Yes** to confirm the alert exclusion rule.
Alert exclusion field descriptions The Rules → **Alert Exclusions** page displays all alert exclusion policies in Cortex Xpanse . The following table describes both the default fields and additional optional fields that you can add to the alert exclusions list view and lists the fields in alphabetical order. | Field | Description | | --------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ![check-box.png](/files/vz0SaKf5zZxtMuEpgbSg) | Checkbox to select one or more alert exclusions on which you want to perform actions. | | BACKWARD SCAN STATUS | Exclusion rule status for historic data, either enabled if you want to apply the policy to previous alerts or disabled if you don’t want to apply the policy to previous alerts. | | COMMENT | Administrator-provided comment that identifies the purpose or reason for the exclusion policy. | | DESCRIPTION | Text summary of the policy that displays the match criteria. | | MODIFICATION DATE | Date and time when the exclusion policy was created or modified. | | NAME | Descriptive name provided to identify the exclusion policy. | | EXCLUSION ID | Unique ID assigned to the exclusion policy. | | STATUS | Exclusion policy status, either enabled or disabled. | | USER | User that last modified the exclusion rule. | | USER EMAIL | Email associated with the administrative user. |
Exclude a specific alert You can exclude individual alerts from the Alerts page, without having to create a specific exclusion rule. In this case, the specific alert is grayed out and will not be reopened. 1. Go to **Incident Response** → **Alerts**. 2. Right-click an alert in the table and select **Manage Alert** → **Exclude Alert**.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/alerts/alert-exclusions.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.