CPT Whitelisting

---

CPT IP Addresses

Whitelist all CVA/H assets that have IP addresses directly on the external network, such as the DIP External IP address

1. Navigate to (Security) Rules -> Shared exception lists
2. Click on [262COS] Global Exception List

Field	Operator	Value
related.ip	is one of	<LIST_OF_CVAH_EXTERNAL_IPS>

CPT User Accounts

Metasponse

note

Already

Field	Operator	Value
file.directory	matches	.*\\Windows\\Temp\\262\\.*