When creating an identity exclusion search, which time range should you select?
IBM QRadar identity exclusion searches must use the Real Time (streaming) timespan so the saved search matches live incoming events and continuously excludes the specified identity data from Asset Profiler updates.
Community Discussion