To reduce false positives from high-priority network indicators related to on-prem proxies, which exclusion is most appropriate?

• A. Exclude network.asset.ip field.
• B. Exclude principal.ip.
• C. Exclude target.domain.
• D. Exclude target.ip.

Answer: (A)

The key idea is reducing noise from internal on-prem proxy traffic by filtering out signals tied to known asset addresses. Excluding the network.asset.ip field suppresses events that reference IPs belonging to assets in your inventory, which is where on-prem proxies typically show activity. By doing this, you prevent alerts driven by internal IP addresses from triggering, while still allowing signals that involve external destinations or unknown hosts to be investigated.

Excluding the user’s IP (principal.ip) would hide who initiated the activity, which can be important for investigations and attribution. Excluding the destination IP (target.ip) or destination domain would remove signals tied to where the traffic is going, potentially masking real threats or other legitimate activity, not specifically addressing the noise from internal proxies.