If default UDM search columns are not relevant, what is an effective way to reduce false positives when a curated high-priority network indicators rule set flags issues due to on-prem proxies?

• A. Configure a rule exclusion for network.asset.ip field.
• B. Configure a rule exclusion for principal.ip.
• C. Exclusion for target.domain.
• D. Exclusion for target.ip.

Answer: (A)

The key idea is to stop the rule from evaluating data in the field that’s causing the false positives. In this scenario, on-prem proxies often appear as the network asset’s IP, so the network indicators rule set may flag issues just because the asset IP field contains the proxy address. By configuring a rule exclusion for the network.asset.ip field, you prevent the rule from using that IP in its evaluation. This directly reduces false positives tied to the proxy data while keeping the rest of the rule logic intact.

Excluding the user’s IP (principal.ip) would remove signals tied to the user, which isn’t addressing the proxy-related noise. Excluding target.domain or target.ip shifts the focus away from the destination information, which doesn’t tackle the proxy IP appearing in the asset data and thus won’t be as effective at cutting those false alarms.