We are trying to reduce noise from Netwrix Alerts when users perform searches in a monitored folder. These alerts often show: Process: C:\Windows\explorer.exe
However, the files are never actually opened or read by the user (Adobe, Word, Excel, etc.)—only searched via Windows Explorer.
Is there a way to modify the alert filter so that it ignores events where the process is C:\Windows\explorer.exe? We only want alerts for actual file access, not simple searches.
Any guidance or best practices for filtering out these benign events would be greatly appreciated!
