Activating and Deactivating Sandflies
You can deactivate a sandfly if you never want it to run. This may be something you want to do if it is causing a false alarm in your environment and whitelisting the alert is not helping.
A sandfly can be deactivated if you never want it to run. This is a valid option if it is causing a false alarm in your environment and whitelisting the alert is not helping.
IMPORTANT: Deactivating vs. WhitelistingDeactivating a sandfly in the master list disables that check for all systems. If there is a false alarm on only one or a few hosts, consider whitelisting the alert instead. A whitelist applies only to the hosts in its scope, not globally. On those hosts, a whitelist either stops the sandfly from running (Disable mode) or converts matching alerts into pass results (Rules mode).
We have worked very hard to ensure false alarms do not happen, but if you have an unusual environment or configuration, it is possible a Sandfly may deem it suspicious and alert. If this happens, try deactivating it by first double-clicking its row in the Sandflies table to open its Sandfly details page. Then simply click the Deactivate button. Use the Activate button to restore its availability. The Status field in the Details section shows the current state: Active or Inactive.
As a reminder, deactivating the sandfly here shuts it off for all systems. If this is not desired, consider whitelisting the sandfly if it is only activating as a false alarm on a few systems.
Globally Deactivating a Sandfly
Updated 2 days ago