Setting an Event Status to False Positive
  • 18 May 2023
  • 1 Minute to read
  • Dark
    Light

Setting an Event Status to False Positive

  • Dark
    Light

Article Summary

Follow these steps to set the status of an Event Group to False Positive, and, if desired, report Indicators associated to the Group as false positives.

Important
You will be prompted to report Indicators associated to the Group as false positives when setting an Event Group’s status to False Positive on the legacy Details screen only.

New Details Screen

  1. Navigate to the Details screen for an Event Group.
  2. On the Overview tab, click EditEdit button_Details card_Details screenat the top right of the Details card, or click on the Status section of the Details card. The Group’s status will now be editable (Figure 1).

    Figure 1_Setting an Event Status to False Positive_7.0.0

     

    • Status: Select False Positive from the dropdown menu.
    • Click ConfirmConfirm icon_Details screento save the changes made to the Group’s status.

Legacy Details Screen

  1. Navigate to the legacy Details screen for an Event Group.
  2. Scroll down to the Details card on the right side of the screen.
  3. Click the value for Status to display a dropdown menu (Figure 2).

    Figure 2_Setting an Event Status to False Positive_7.0.0

     

    • Status: Select False Positive from the dropdown menu.
    • Click SaveSave iconto save the changes made to the Group’s status.
  4. After the Group’s status is set to False Positive, the Apply False Positive window will be displayed. Click the YES button to report all Indicators associated to the Group as false positives, if desired.

ThreatConnect® is a registered trademark of ThreatConnect, Inc.

20047-04 v.09.B


Was this article helpful?