Skip to main content
Skyhigh Security

Include or Exclude a User from a Custom Anomaly Rule

Including or excluding a User is a powerful way to apply a custom anomaly rule to your deployment. For example, you could do this when you need to include or exclude a group of users who are working from a restricted location.

In custom anomaly, Exclude always takes precedence over Include. If you accidentally try to add a User to both Include and Exclude, you will see an error message asking you to choose one or the other.

To include or exclude a User from a custom anomaly rule:

  1. Sign in to Skyhigh CASB.
  2. Go to Incidents > Anomalies > Anomaly Settings.
  3. Click Actions > Create a Custom Anomaly or click the name of an existing custom anomaly rule to edit it.
  4. On the Name & Scope page:
    • Enter a Name for the rule, and an optional Description.
    • Select Service Instances to which the rule should apply.
  5. Under Users > Include All Users, click Edit and select from the list. 
    clipboard_ea67021a9924f977fe3566b37faa19ecf.png
  6. Click Done
  7. To exclude users, click Add Exclusions and select from the list. 
    clipboard_ec919c8f0e53fbb8541b86a7206614c63.png
  8. Click Done
  9. Follow the wizard to enter selections for the Rules & Exceptions page, then Review and save your custom anomaly configuration. For details see, Create or Edit a Custom Anomaly
  • Was this article helpful?