We can create an ip and username specific whitelist for the data triggered as action object in an alarm. Logsign USO must be in version 6.4.53 for this feature.
To do this, you need to enter Logsign USO with administrator authorization and go under settings.
Click on WhiteList in the Alerts & Incidents tab.
Then click on the + White List tab at the top right, a screen will appear in front of you. In this field, you can prepare it as I sent the image below.
The data to be referenced in the Data field must correspond to the data received with Action.Object.
Example;
1.1.1.1
logsignsupport
443
8.8.8.8
google.com
Note: Each new line in the Data section is treated as a new value. You do not need to go down to the bottom line with a comma.
After creating the data side, you need to select which alarms you want to use this whitelist for.
Click on Alerts and then select the alarms you want from the alarm screen and save them.
You can see the name of the description you wrote in the WhiteList in the alarms you selected as in the image below.
After these operations, no alarm will occur for the username and ip addresses you specify.