---
title: Muted Indicators
description: >-
  Mute indicators of compromise that are benign for your organization so Cloud
  SIEM rates them as benign. Covers how muting changes log enrichment,
  Datadog-managed muted indicators, and how to mute, review, and unmute
  indicators.
breadcrumbs: Docs > Datadog Security > Cloud SIEM > Ingest and Enrich > Muted Indicators
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Muted Indicators

## Overview{% #overview %}

Threat intelligence feeds can flag an indicator that is harmless for your organization, such as your corporate VPN egress IP address, a sanctioned cryptomining pool, or the domain of an internal tool. Muting an indicator tells Cloud SIEM to rate it as `benign` for your organization, so your team can stop triaging the same false positives.

Muting does not remove threat intelligence. Muted indicators keep their enrichment and stay visible in the [IOC Explorer](https://docs.datadoghq.com/security/cloud_siem/triage_and_investigate/ioc_explorer.md), so you can still search for them and see why they were flagged.

Indicators can be muted in two ways:

- **Datadog-managed**: Datadog maintains a list of known-benign indicators, such as widely used domains, and mutes them for every organization. This list is read-only.
- **Muted by your organization**: Indicators your team mutes. These mutes apply to your organization only, and you can unmute them at any time.

## How muting works{% #how-muting-works %}

When an indicator is muted, Cloud SIEM changes how it enriches new logs that match the indicator:

- The [intention](https://docs.datadoghq.com/security/threat_intelligence.md#threat-intelligence-intents) of each eligible threat intelligence result changes to `benign`.
- The log keeps the rest of its threat intelligence enrichment, such as the source and category, and is marked with `has_been_muted: true`.
- The indicator's IOC score remains the same.

Muting applies to logs that Cloud SIEM processes after the mute takes effect. Logs that were already processed keep their original enrichment.

### When a mute or unmute takes effect{% #when-a-mute-or-unmute-takes-effect %}

- **IOC Explorer**: Shows the new mute state immediately.
- **Log enrichment**: May take up to an hour to apply. During that time, new logs and detections based on them may still use the original rating.

### Threat intelligence that muting does not change{% #threat-intelligence-that-muting-does-not-change %}

Muting your organization's indicators does not change ratings from:

- Threat intelligence you bring yourself through [reference tables](https://docs.datadoghq.com/security/cloud_siem/ingest_and_enrich/threat_intelligence.md)
- Threat Intelligence Platform (TIP) integrations: MISP, OpenCTI, and Anomali ThreatStream

## Prerequisites{% #prerequisites %}

- Your organization must subscribe to Cloud SIEM
- You need the following [permissions](https://docs.datadoghq.com/account_management/rbac/permissions.md#cloud-security-platform):
  - To view muted indicators: `security_monitoring_signals_read`
  - To mute or unmute indicators: `security_monitoring_signals_write`

## Limits{% #limits %}

| Limit                                | Value                                 |
| ------------------------------------ | ------------------------------------- |
| Active mutes per organization        | 10,000                                |
| Indicators per mute or unmute action | 100                                   |
| Reason length                        | 100 characters                        |
| Supported indicator types            | IP address, domain, SHA-256 file hash |

When your organization reaches 10,000 active mutes, unmute indicators you no longer need before you mute new ones.

## Mute indicators{% #mute-indicators %}

You can mute IP addresses, domains, and SHA-256 file hashes. Mute single values only. CIDR ranges cannot be muted, so mute individual IP addresses instead.

### Mute an indicator{% #mute-an-indicator %}

1. Go to Security > Cloud SIEM > Investigate > [IOC Explorer](https://app.datadoghq.com/security/siem/ioc-explorer).
1. Click an indicator to open its side panel.
1. Click Mute This IoC.
1. Optionally, enter a reason for muting, such as `Corporate VPN egress`. The reason can be up to 100 characters and appears on the Muted Indicators page.
1. Click Mute.

### Mute multiple indicators{% #mute-multiple-indicators %}

1. Go to Security > Cloud SIEM > Investigate > [IOC Explorer](https://app.datadoghq.com/security/siem/ioc-explorer).
1. Select the checkboxes next to the indicators you want to mute. You can mute up to 100 indicators at a time.
1. In the bulk actions menu, click Mute.
1. Optionally, enter a reason for muting. The reason applies to every selected indicator.
1. Confirm the action.

Selected indicators that are already muted, by your organization or by Datadog, do not change as a result of a second muting action.

## Review muted indicators{% #review-muted-indicators %}

The Muted Indicators page lists every active mute, from Datadog and from your organization. To open it, do either of the following:

- Go to Security > Settings > Cloud SIEM > [Muted Indicators](https://app.datadoghq.com/security/configuration/siem/muted-indicators).
- In the [IOC Explorer](https://app.datadoghq.com/security/siem/ioc-explorer), click Muted Indicators. The list opens in a side panel. Click Open full page to go to the settings page.

For each indicator, the list shows the indicator type, scope, and reason. Datadog-managed rows show the source feed. Rows muted by your organization show who muted the indicator and when. Use the search bar to filter by indicator, indicator type, scope (your organization or Datadog-managed), source, or reason.

### Find muted indicators in the IOC Explorer{% #find-muted-indicators-in-the-ioc-explorer %}

In the [IOC Explorer](https://app.datadoghq.com/security/siem/ioc-explorer), the Custom mute column shows Muted for indicators your organization muted. To show only those indicators, filter with the Muted facet.

The column and facet reflect your organization's mutes only. Indicators muted only by Datadog don't appear as muted in this column or facet. To see every mute, use the Muted Indicators page.

### View mute history{% #view-mute-history %}

The Conversation tab in an indicator's side panel lists every mute and unmute event, who performed it, and when. These events appear alongside the indicator's comments and triage changes.

## Unmute indicators{% #unmute-indicators %}

You can unmute indicators that your organization muted. Datadog-managed mutes are read-only.

To unmute indicators, do one of the following:

- In the [IOC Explorer](https://app.datadoghq.com/security/siem/ioc-explorer), open the indicator's side panel and click Un-mute This IoC.
- On the [Muted Indicators page](https://app.datadoghq.com/security/configuration/siem/muted-indicators), click Un-mute on the indicator's row.
- On the Muted Indicators page, select up to 100 indicators and click Un-mute.

If Datadog also mutes the indicator, unmuting removes only your organization's mute. The indicator stays rated as `benign`.

## Further reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [Investigate indicators with the IOC Explorer](https://docs.datadoghq.com/security/cloud_siem/triage_and_investigate/ioc_explorer.md)
- [Threat intelligence in Datadog Security](https://docs.datadoghq.com/security/threat_intelligence.md)
- [Bring your own threat intelligence to Cloud SIEM](https://docs.datadoghq.com/security/cloud_siem/ingest_and_enrich/threat_intelligence.md)