Hi is there a way to mute an IPS email alert via correlation events for a GID/SID combo? I tried matching based on rule name, but I want an "IS NOT" option (to filter out email alerts to not send). You can filter SID, but the problem is, multiple rules match the SID you need the GID-SID number to identify the exact rule and I don't see a way to do that.
