The global exclusion list lets you create an "allowed list" that prevents rule matches from occurring for known scanning devices or from segmented guest networks. Every Trellix rule contains a clause that excludes logs with source IPs from a specific list:
(NOT srcipv4:$exclusions.global.srcipv4)
Any IP address or CIDR range included in a list named exclusions.global.srcipv4 will not be matched with any Trellix rule.
To create a global exclusion:
From the main menu, select Configure > Lists, and click Create List.
Name the list
exclusions.global.srcipv4, and click Create.Add IP addresses or CIDR ranges to the list as indicators. Do not add domain names to this list.
If the addition is a CIDR range, select Misc from the Type menu. If it is an IP address, select IPv4.
Click Create New List to save.