VariableGLOB_ALLOW_LIST_EMAIL_ACTIONS
Introduced Version1.74
DescriptionBlocks recipients of email actions that are not in the provided allow list.
DefaultAllow all

This variable enables cluster-wide blocking of recipients of Email actions that are not in the provided allow list. It takes a comma-separated list of patterns, with globbing pattern supported if a * is included in the value.

Example: GLOB_ALLOW_LIST_EMAIL_ACTIONS=*crowdstrike.com,helloworld@example.com.