2 min read · alerts · ops
Quiet the scanners, keep the incidents
Token and tenant exclusions still store the trigger. They only skip the notification.
Exclusions are for known-good traffic: your office NAT, a vulnerability scanner you own, uptime bots that hit a planted URL.
The trigger row still lands in history. You can audit later. Alerts and webhooks are what get skipped.
Prefer tight IP exclusions over broad user-agent matches. A botnet can spoof a UA; it cannot sit on your office IP.