Qradar global whitelist Use Routing Rules with forwarding > bypass correlation For IP ranges, use Network Hierarchy.