Skip to main content

False Positives

Introduced in v9.2.0

A false positive is a false alarm. This occurs when the system identifies an attack and triggers an alarm but it is acceptable behavior.

False positives are security alerts indicating there is a threat but actually these are non malicious and are not threats.

Refer this video to tag/untag a signal as False Positive:

You can also tag/untag an already raised signal as false positive, following are the steps:

  • On this same signal listing page, select the particular signal that you want to tag/untag as false positive.

  • Click on the circle with the minus sign icon displayed next to the confidence column on the right against the signal and select Tag as False Positive/Untag as False Positive.

  • Once tagged as false positive, signals will not be raised from this particular source.

  • All signals tagged as false positive can be viewed under Triaged Signals on the signals list page.

  • Signals that are untagged as False Positive can be viewed under the Pending Review signals list page.

  • You can also tag/untag multiple signals at a time.