> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/intrusion-detection-system/whitelist/add-whitelist-entry.md). # Add Whitelist Entry Click **Create Whitelist Entry** in the upper right corner of the [whitelist overview](/docs/manual/english/platform-usage/hosts/intrusion-detection-system/whitelist.md#whitelists-overview) to add a new whitelist entry. The **Hosts** → **Intrusion Detection System** → **Whitelists** → **Add** view opens.

Click **Add Whitelist** after you configured all settings to save and create the new whitelist entry. Click **Back** to return to the overview. {% hint style="danger" %} **Please note**: If you leave this view without clicking **Add Whitelist**, all configured settings will be permanently lost. {% endhint %} *** ## General Settings Her you can configure various basic settings.

The following options are available:

Option	Description
Description	Provide a more detailed description for the whitelist entry. This field is optional.
CIDR	Enter the subnet whose associated IP addresses should be classified as trusted in Classless Inter-Domain Routing (CIDR) notation.
Attack Category	Enter the specific attack categories for which the IP addresses defined by the subnet should be classified as trusted. You can use wildcards () here. For example, enter only the wildcard character () to include all attack categories. However, we recommend that you test the corresponding attack filters beforehand using the filter function in the network anomalies overview. For more information on detected attack types, see our Knowledge Base: What types of network attacks does the Enginsight IDS detect?
Extended Filter	Define the whitelist entry more precisely by restricting it to specific Details read from the network anomalies overview. For example, you can specify the payload of the attack here, if available. This field is optional. You can use wildcards (*) here.

*** ## Assigned References Here you can define the hosts or groups of hosts to which the configured settings should apply.

The following options are available:

Option	Description
Hosts	Define the hosts to which the configured settings should apply. Click the Hosts field to expand a list of all available hosts, then select one or more hosts. Alternatively, use the free-text search to find hosts in the list more quickly. Click the Remove icon next to an added host to remove it from the Hosts field.
Tag Logic	Define how many tags an assigned host must have for the settings to apply to it. The default tag logic is All Tags are Present in the Reference. Click the Tag Logic field to expand a list of all available options. The following options are available: All Tags are Present in the Reference: An assigned host must have all specified tags for the settings to apply to it. At Least One of the Specified Tags is Present: An assigned host must have at least one of the specified tags for the settings to apply to it.
Tags	Define tags for groups of hosts to which the configured settings should apply. Click the Tags field to expand a list of all available tags, then select one or more tags. Alternatively, use the free-text search to find tags in the list more quickly. Click the Remove icon next to an added tag to remove it from the Tags field.

Option

Description

Hosts

Define the hosts to which the configured settings should apply.

Click the Hosts field to expand a list of all available hosts, then select one or more hosts. Alternatively, use the free-text search to find hosts in the list more quickly.

Click the Remove icon next to an added host to remove it from the Hosts field.

Tag Logic

Define how many tags an assigned host must have for the settings to apply to it.

The default tag logic is All Tags are Present in the Reference.

Click the Tag Logic field to expand a list of all available options.

The following options are available:

All Tags are Present in the Reference: An assigned host must have all specified tags for the settings to apply to it.
At Least One of the Specified Tags is Present: An assigned host must have at least one of the specified tags for the settings to apply to it.

Tags

Define tags for groups of hosts to which the configured settings should apply.

Click the Tags field to expand a list of all available tags, then select one or more tags. Alternatively, use the free-text search to find tags in the list more quickly.

Click the Remove icon next to an added tag to remove it from the Tags field.

### Excluded References Here you can define which hosts or groups of hosts should be explicitly excluded from the configured settings. {% hint style="info" %} Defining excluded hosts is optional. {% endhint %} Click **Define Exceptions** next to **Assigned Hosts** to show the options for **Excluded Hosts**.

Configure all settings as described for an assigned host. *** ## Further Resources **Knowledge Base** * [What types of network attacks does the Enginsight IDS detect?](https://docs.enginsight.com/docs/knowledge-base/english/intrusion-detection-system-ids/what-types-of-network-attacks-does-the-enginsight-ids-detect) ***