Suppress detections with tuning parameters

Specify tuning parameters to improve metrics and suppress low-value detections from ever being generated.

1. Log in to the ExtraHop system through https://<extrahop-hostname-or-IP-address>.
2. Click the System Settings icon and then click Tuning Parameters.
3. Specify values for any of the following parameters available on the page.

   Option	Description
   Gateway Devices	By default, gateway devices are ignored by rules-based detections because they can result in redundant or frequent detections. Select this option to identify potential issues with gateway devices such as your firewalls, routers, and NAT gateways.
   Inbound Tor Nodes	By default, inbound connections from known Tor nodes are ignored by rules-based detections because they can result in low-value detections in environments with minimal Tor traffic. Select this option to identify detections on inbound connections from known Tor nodes if your environment observes substantial incoming Tor traffic.
   Outbound Tor Nodes	By default, outbound connections to known Tor nodes are ignored by rules-based detections because they can result in low-value detections in environments with minimal Tor traffic. Select this option to identify detections on outbound connections to known Tor nodes if your environment observes substantial outgoing Tor traffic.
   Accelerated Beaconing Detection	By default, the ExtraHop system detects potential beaconing events over HTTP and SSL. Select this option to detect beaconing events faster than the default detection. Note that enabling this option can increase the detection of beaconing events that are not malicious.
   Privileged Active Directory Accounts	Specify regular expressions (regex) that match privileged Active Directory accounts in your environment. The parameter list includes a default list of regular expressions for common privileged accounts that you can edit. The ExtraHop system identifies privileged accounts and tracks account activity in Kerberos records and metrics.
   Allowed DNS Sinkhole IP Addresses	Specify sinkhole IP addresses that are allowed to be returned in DNS query responses that you want rules-based detections to ignore. Specify a valid IP address or CIDR block.
   Allowed Public DNS Servers	Specify public DNS servers allowed in your environment that you want rules-based detections to ignore. Specify a valid IP address or CIDR block.
   Allowed HTTP CONNECT Targets	Specify URIs that your environment can access through the HTTP CONNECT method. URIs must be formatted as <hostname>:<port number>. Wildcards and Regex are not supported. If you do not specify a value, detections that rely on this parameter are not generated.

4. Click Save.

If you encounter a low-value detection, you can add tuning parameters and trusted domains directly from a detection card to keep similar detections from generating.

1. Log in to the ExtraHop system through https://<extrahop-hostname-or-IP-address>.
2. At the top of the page, click Detections.
3. Click Actions from the lower-left corner of the detection card.
4. Click Tune Detection....
   If the detection type is associated with a tuning parameter, you will see the option to suppress the detection by adding a tuning parameter or trusted domain. If the detection does not have an associated tuning parameter, you can hide the detection with a tuning rule.

   
   

   

   
   

5. Click the Suppress detections... option and click Save.
   The Tuning Parameter Added confirmation appears and the new parameter is added to the Tuning Parameters page. For trusted domains, the domain is added under Trusted Domains on the Network Localities page.