🎉 ThreatConnect® 7.12 is now available! We love customer feedback. Write a review of ThreatConnect and we'll give you up to $50 as a thank-you gift!

False Positives Overview

  • Updated on Mar 18, 2024
  • Published on Jul 19, 2022
  • 1 minute(s) read
Prev Next

Overview

A false positive refers to an Indicator that has been erroneously classified as malicious. ThreatConnect® allows users to report false positives, although this feature is limited to once a day per Indicator per user; thus, different users may report the same Indicator once on the same day. The status of the Event Group can also be set to “False Positive,” and, if desired, all Indicators associated to the Event can be marked as false positives.

Before You Start

Minimum Role(s)
  • Organization role of Read Only User (for viewing false-positive counts and dates on which false positives were reported) 
  • Organization role of Standard User (for reporting false positives) 
  • Organization role of Organization Administrator (for enabling data from API users to be included in the observations and false-positive counts)
PrerequisitesAn Indicator or Event Group

ThreatConnect® is a registered trademark of ThreatConnect, Inc.

20047-01 v.08.A

Related articles
  • The Details Screen
    ThreatConnect Platform > Threat Intelligence > Viewing Threat Intelligence Data
Company
Sales and Support
Follow Us
© 2012–2024 ThreatConnect, Inc. All Rights Reserved.