Environment
- EDR Console: All versions
Question
Would selecting "ignore future report" for a feed report stop a watchlist which has a query on that feed from alerting?
For example, ignoring an IOC threat report from the SRSThreat feed while having a watchlist querying on alliance_score_srsthreat:100.
Answer
No, "ignore future report" does not stop a watchlist from alerting.
Additional Notes
The action is for feed alerting only. All the back-end tagging still works as normal. So watchlist would still pick it up.
