We are rolling out AMP and have various processes and files flagged as malicious by the tool that are approved to use and we are OK with these items running on our endpoints. We have added the SHA values to Allowed Applications, but noticed the dashboard inbox still sends alerts about these items. As a result we decided to build exclusions based on Process or Threat or Path or a combination to prevent AMP from continuing to scan and flag these In the end none of these methods have worked to prevent these items from continuing to be flagged in the dashboard inbox as requiring attention. Understand there is the ability to mute artifacts on the dashboard, but that does not mute these items from being displayed on the endpoint itself.
Generally looking for a way that we can tell AMP that we are OK with a particular process, file or action and not have it continue to alert about things we have allowed and approved. Otherwise the inbox and alerts are mostly noise and would result in analysts resolving approved apps instead of investigating real threats.
Assume we are missing something here and any help would be appreciated.
