How to tune a Playbook

[thegreekman]

Hello, I read the documentation on tuning playbooks but I am still a little confused on how to accomplish the following:
One of the Windows playbook rules keeps alerting on the same rule for the same device. This is expected activity. What would be the appropriate syntax to tune out the alert if it matches a certain IP or hostname?

[robbiemarshall]

You would use a custom filter. The documentation for using these is found here: https://docs.securityonion.net/en/2.3/playbook.html?highlight=playbook#tuning-plays