# Tons of Alerts Using "Threat Intel Indicator Match" **URL:** \ **Category:** Elastic Security\ **Created:** [October 17, 2022, 12:52pm UTC](https://discuss.elastic.co/t/tons-of-alerts-using-threat-intel-indicator-match/316783 "2022-10-17T12:52:57Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Viral-Technology](https://avatars.discourse-cdn.com/v4/letter/v/d6d6ee/32.png) [@Viral-Technology](https://discuss.elastic.co/u/Viral-Technology)\ **Post date:** [October 17, 2022, 12:52pm UTC](https://discuss.elastic.co/t/tons-of-alerts-using-threat-intel-indicator-match/316783/1 "2022-10-17T12:52:57Z")
Hello Elastic Community!! in the last few days I have received a ton of alerts using "Threat Intel Indicator match" it is matching specific ports with specific Ip addresses. however, after researching, I have found these alerts are being generated from a server running azure ad connect. it is matching the source.ip to 127.0.0.1 and soure.ports are between the ranges of 49152 - 65535 which also happens to be the ports that rpc uses during password sync...every 15 minutes. my question is I am trying to create a exception that looks like this source.ip is 127.0.0.1 and host.name is "server.name" source.port is one of 49152 - 65535 the problem I am having is how do I create a range of ports in exceptions? would I need to create a list under manage rules? [Rule exceptions and value lists | Elastic Security Solution [8.4] | Elastic](https://www.elastic.co/guide/en/security/current/detections-ui-exceptions.html) ---
**Author:** ![vitaliidm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitaliidm/32/101610_2.png) [@vitaliidm](https://discuss.elastic.co/u/vitaliidm)\ **Post date:** [October 17, 2022, 4:38pm UTC](https://discuss.elastic.co/t/tons-of-alerts-using-threat-intel-indicator-match/316783/2 "2022-10-17T16:38:19Z")
hi, @Viral-Technology According to [Rule exceptions | Elastic Security Solution [8.11] | Elastic](https://www.elastic.co/guide/en/security/current/detections-ui-exceptions.html) value list exceptions can be created only for 4 types of fields: > You can create value lists with these types: > > - `Keywords` (many [ECS fields](https://www.elastic.co/guide/en/ecs/8.4/ecs-field-reference.html) are keywords) > - `IP Addresses` > - `IP Ranges` > - `Text` and `source.port` has mapping type of `long` according to [Source Fields | Elastic Common Schema (ECS) Reference [8.4] | Elastic](https://www.elastic.co/guide/en/ecs/8.4/ecs-source.html#field-source-port) Are there any other properties in events that can be used to identify which ones can be filtered, apart from `source.port`? ---
**Author:** ![Viral-Technology](https://avatars.discourse-cdn.com/v4/letter/v/d6d6ee/32.png) [@Viral-Technology](https://discuss.elastic.co/u/Viral-Technology)\ **Post date:** [October 17, 2022, 5:57pm UTC](https://discuss.elastic.co/t/tons-of-alerts-using-threat-intel-indicator-match/316783/3 "2022-10-17T17:57:34Z")
sadly not for this particular rule, it is alerting when source ip and source.port match. I'll look into maybe trying to figure out how to disable that particular rule. ---
**Author:** ![vitaliidm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitaliidm/32/101610_2.png) [@vitaliidm](https://discuss.elastic.co/u/vitaliidm)\ **Post date:** [October 18, 2022, 8:43am UTC](https://discuss.elastic.co/t/tons-of-alerts-using-threat-intel-indicator-match/316783/4 "2022-10-18T08:43:41Z")
There is a possible workaround: [Duplicate this prebuilt rule](https://www.elastic.co/guide/en/security/8.4/rules-ui-management.html#manage-rules-ui) and then add filters on rule edit page, that restricts port values ![Screenshot 2022-10-18 at 09.42.39](https://us1.discourse-cdn.com/elastic/original/3X/f/7/f7ac8adf57236933041eb54455fe4c0b7c4b4197.png) ---
**Author:** ![Viral-Technology](https://avatars.discourse-cdn.com/v4/letter/v/d6d6ee/32.png) [@Viral-Technology](https://discuss.elastic.co/u/Viral-Technology)\ **Post date:** [October 18, 2022, 11:44am UTC](https://discuss.elastic.co/t/tons-of-alerts-using-threat-intel-indicator-match/316783/5 "2022-10-18T11:44:15Z")
Vitalii, Awesome! thank you so much. I have a ton to learn and we will be completing some of the training soon! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 15, 2022, 11:44am UTC](https://discuss.elastic.co/t/tons-of-alerts-using-threat-intel-indicator-match/316783/6 "2022-11-15T11:44:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.