VariableGLOB_ALLOW_LIST_EMAIL_ACTIONS
Introduced Version1.74
Description Blocks recipients of email actions that are not in the provided allow list.
DefaultAllow all

This variable enables cluster-wide blocking of recipients of Action Type: Email actions that are not in the provided allow list. It takes a comma-separated list of patterns, with globbing pattern supported if a * is included in the value.

Example:

ini
GLOB_ALLOW_LIST_EMAIL_ACTIONS=*crowdstrike.com,helloworld@example.com