Manage Restricted Country User Allowlist

If the Restricted Country User Allowlist rule is configured, alerts are generated only for sign-in attempts from unlisted countries by unlisted users.

These resources are required:
  • Administratorberechtigungen für Arctic WolfUnified Portal.

    Sie müssen ein primärer oder sekundärer Kontakt sein. Wenn Sie diese Zugriffsstufe benötigen, reichen Sie Ihre Anfrage bei einem primären oder sekundären Kontakt in Ihrer Organisation ein, oder klicken Sie auf Request an Update. Weitere Informationen finden Sie unter Request an alert configuration rule update.

  1. Melden Sie sich bei Arctic Wolf Unified Portal an.
  2. Klicken Sie im Navigationsmenü auf Organisationsprofil > Alarmkonfigurationsregeln.
  3. Click Manage Configurations.
  4. For the Restricted Country User Allowlist rule, under Actions, click Create Configuration or View.
    The option that appears depends on whether this rule is already configured.
    Note: Time-related fields and suppressions default to Coordinated Universal Time (UTC) and not your local timezone.
  5. Do one of these actions:
    • To edit an existing entry — In the corresponding table row, under Actions, click Edit.
    • To add a new entry — Click Add Entries .
  6. Edit the list of approved countries:
    • To add a country — In the Add Countries field, start typing the name of a country, and then select a country from the list.
    • To remove a country — Click for a country listed under the Add Countries field.
  7. Edit the list of approved users:

    • To add a user — In the Add Usernames field, type a username, and then click Add or press Enter.

      Note:
      • Usernames and email formats are case sensitive. Incorrect case-sensitivity will cause suppressions to fail.
      • We recommend that you add users in both of these formats as separate entries: username and username@domain. Make sure that you click Add or press Enter after each entry.

    • To remove a user — Click for a user listed under the Add Usernames field.

  8. Optional: To configure start and end dates for this entry, in each date field, click Calendar and select a date.
    Tip: The rule will expire on the end date. For example, if the selected end date is March 16, the rule will be effective on March 15 and will stop being effective on March 16.
  9. Click Apply.