Exclusions filter out noisy or irrelevant events before they are forwarded. They are evaluated first in the pipeline, so an excluded event never reaches a policy, a route or a destination.
¶ What an exclusion contains
- Name — a human-readable label.
- Action — what to do with a matching event:
drop_from_destination— do not forward it at all.suppress_alert— keep it but do not raise an alert.reduce_severity— lower its severity so it falls below policy thresholds.aggregate_only— count it for statistics but do not forward each occurrence.
- Audit keys — match on the originating audit rule key (e.g.
time-change). - Executables — match on the program that generated the event (e.g.
/usr/sbin/chronyd). - Paths — match on the file path involved (exact, prefix, glob or regular expression).
¶ How to use it
Click New exclusion to open the editor, describe what to match, choose the action and click Apply. A common pattern is to forward a whole category with a policy, then add one or two exclusions to silence the predictable, high-volume events (time-sync writes, a backup agent touching many files) that would otherwise flood the SIEM.
Exclusions are the "deny/tune" layer. Because they run before policies, they are the right place to control volume and cost without weakening your positive selection rules.