Purpose
The SecOpsWinPermittedDomains Lookup adds whitelisting functionality to your Devo Detections by allowing them to reference this Lookup of permitted domains. Using this Lookup will lower your false positive rate when properly configure and can help make your alerts more actionable.
Open SecOpsWinPermittedDomains Lookup
Once you have installed the Lookup and assigned it to your role you can access the Lookup in the following ways:
Go to Exchange in the navigation pane and look for the Lookup you want to open. Click Open.
Go to Data Search → Lookup Management. You will see a list with your Lookups available, including the ones that you download via Exchange. You can use the filter to open the Lookup you downloaded.
Work with Lookups
Refer to Manage and edit lookup tables article to know how to work with Lookups.