False Positives

This article describes false positives in ThreatConnect and the corresponding minimum role and prerequisites for this feature.

This article describes how to view and report false positives for an Indicator via its Details screen.

This article describes how Organization Administrators can enable false positive data provided by API users to be included in the Observations/False Positives card for Indicators.

This article describes how to set the status of an Event Group to False Positive and, if desired, report Indicators associated to the Group as false positives.