Setting an Event Status to False Positive
- 02 Sep 2022
- 1 Minute to read
-
Print
-
DarkLight
Setting an Event Status to False Positive
- Updated on 02 Sep 2022
- 1 Minute to read
-
Print
-
DarkLight
Follow these steps to set the Status of an Event Group to False Positive, and, if desired, mark Indicators associated to the Event as false positives:
- Navigate to the Details screen of an Event Group (Figure 1). For instructions on accessing a Group’s Details screen, see the “Viewing the Details Screen” section of The Details Screen.
- Scroll down to the Details card on the right side of the screen (Figure 2).
- Click the Event Group’s Status (Needs Review in Figure 2) to display the Status dropdown menu (Figure 3).
- Select False Positive from the dropdown menu, and click Save
(Figure 3). The Event Group’s Status will change to False Positive, and the Apply False Positive window will be displayed.
- Click the YES button to mark all Indicators associated to the Event Group as false positives, if desired.
ThreatConnect® is a registered trademark of ThreatConnect, Inc.
20047-04 v.08.A
Was this article helpful?