Setting an Event Status to False Positive
  • 02 Sep 2022
  • 1 Minute to read
  • Dark

Setting an Event Status to False Positive

  • Dark

Follow these steps to set the Status of an Event Group to False Positive, and, if desired, mark Indicators associated to the Event as false positives:

  1. Navigate to the Details screen of an Event Group (Figure 1). For instructions on accessing a Group’s Details screen, see the “Viewing the Details Screen” section of The Details Screen.

    Graphical user interface, application  Description automatically generated


  2. Scroll down to the Details card on the right side of the screen (Figure 2).

    Text  Description automatically generated


  3. Click the Event Group’s Status (Needs Review in Figure 2) to display the Status dropdown menu (Figure 3).

    Graphical user interface  Description automatically generated with medium confidence


  4. Select False Positive from the dropdown menu, and click SaveIcon  Description automatically generated (Figure 3). The Event Group’s Status will change to False Positive, and the Apply False Positive window will be displayed.
  5. Click the YES button to mark all Indicators associated to the Event Group as false positives, if desired.

ThreatConnect® is a registered trademark of ThreatConnect, Inc.

20047-04 v.08.A

Was this article helpful?