Skip to main content
McAfee Enterprise MVISION Cloud

Create Anomaly Exceptions

Use Anomaly Exceptions to create an allow list of known behaviors that should no longer trigger Sanctioned Service anomalies.

For example, if your organization deletes inactive users at the end of each month, you can create an exception based on the Account Deletion anomaly and the date range you expect to delete user accounts during. Or, if users access their system using a VPN triggering the Superhuman Anomaly, you can create an anomaly exception preventing your VPN's IP address from triggering the Superhuman Anomaly.

NOTE: You cannot create exceptions for Shadow Service Anomalies.

To create an Anomaly Exception:

  1. Go to Incidents > Anomalies > Anomalies.
  2. Select the required Service from the menu. 
  3. Search for the exception criteria in the Omnibar. For example, if at the end of every quarter HR deletes old user accounts, run an Omnibar query for the user names of the users who do the deletion, Account Deletion anomaly, and the timeframe that the deletion will occur.
  4. Under Actions, click Create an Exception.
    clipboard_eb9e1f9ea77dc26a9847c76922e6e95ff.png
  5. Enter the name for the exception and click Save Changes.
    clipboard_e9511b6d9dfea6204629c0609ee193853.png
    Once the changes are saved, a successful message is displayed at the bottom of the page and anomalies displayed per the filters are suppressed.
  • Was this article helpful?