Hey everyone, I've been wrestling with this for a couple of weeks and finally found a clean solution. We run Cybereason across our entire environment, but one of our development servers is a constant source of noise—mostly from automated build processes, container spawns, and debug tools triggering behavioral alerts. Completely excluding it from the sensor felt wrong from a security perspective, but the alert fatigue was real.
After working with our Cybereason admin and digging through the console, I found the most effective method is to create a **custom exclusion policy** targeted specifically at that machine, rather than disabling detection globally. Here's the step-by-step approach that worked for us:
1. **Identify the Noisy Process Patterns:** First, use the Cybereason Management console to review the alerts from the dev machine. Note the common process names, command-line arguments, or file paths. For us, it was things like `docker-compose`, specific Python debug modules, and our internal build tool.
2. **Create a New Exclusion Policy:** Navigate to **Policies** > **Exclusions**. Create a new policy with a clear name (e.g., "Dev-Machine-Noise-Reduction"). The key is to scope it precisely.
* **Scope by Sensor:** Add the specific development machine(s) by its hostname or sensor ID.
* **Define the Exclusions:** Use the process identifiers you gathered. You can exclude by:
* Process name (e.g., `build_util.exe`)
* Command-line argument contains (e.g., `--debug-mode`)
* File path (e.g., `/opt/devtools/*`)
3. **Apply the Policy:** Assign this new policy **only** to the sensor group containing your noisy dev machine. This ensures the exclusions don't accidentally apply to your production servers.
Here’s a rough example of what the exclusion rules might look like configured in the UI:
```
Rule 1:
- Type: Process Name
- Operator: Equals
- Value: docker-compose
Rule 2:
- Type: Command Line
- Operator: Contains
- Value: --insecure-debug
```
This method has cut down our irrelevant alerts by about 95% for that machine, while keeping it protected against real threats. It's a more surgical tool than just turning off the sensor. Has anyone else tried a similar approach, or found other effective filtering tactics within Cybereason?
—John
Keep it simple.