Hide detection without an existing group

If I have a detection that I want to hide for a device group that is not yet existing, is it expected behavior that if I create that device group it is not showing up for that detection that has fired before I created that new device group?

The determination of relevant device groups for hiding a detection is calculated when you’re creating the rule rather than when the detection was created. If you’re not seeing the group, that could imply the system doesn’t believe the group covers all the necessary offenders (or victims).

Hi Tedd,
thanks for the explanation, I’ll see if that could have been the mistake!