Abstract
When a user whitelists an entity (an IP address, account, host, URL, or file hash) against a specific security detection rule, the platform automatically derives which query columns of that rule carry the entity, by reading the rule's own entity-mapping metadata, and materializes column-level suppression entries that the rule can evaluate at query time. In one embodiment the entries are written to a lookup watchlist in the tenant's own workspace, which detection rules join against. In a further embodiment, a shared suppression function is injected into every detection rule's query at deployment time, with per-rule column bindings derived automatically from the same entity-mapping metadata, so suppression logic is centralized, updated in one place, and applied consistently across all rules.
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.
Recommended Citation
AlpenShield GmbH, "Entity Whitelisting Translated to Query-Column-Level Suppression by Introspecting a Detection Rule's Own Entity Mappings", Technical Disclosure Commons, ()
https://www.tdcommons.org/dpubs_series/11432