Setting an Event Status to False Positive

Follow these steps to set the status of an Event Group to False Positive, and, if desired, report Indicators associated to the Group as false positives.

New Details Screen

1. Navigate to the Details screen for an Event Group.
2. On the Overview tab, click Editat the top right of the Details card, or click on the Status section of the Details card. The Group’s status will now be editable (Figure 1).

   

    

   • Status: Select False Positive from the dropdown menu.
   • Click Confirmto save the changes made to the Group’s status.

Legacy Details Screen

1. Navigate to the legacy Details screen for an Event Group.
2. Scroll down to the Details card on the right side of the screen.
3. Click the value for Status to display a dropdown menu (Figure 2).

   

    

   • Status: Select False Positive from the dropdown menu.
   • Click Saveto save the changes made to the Group’s status.
4. After the Group’s status is set to False Positive, the Apply False Positive window will be displayed. Click the YES button to report all Indicators associated to the Group as false positives, if desired.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20047-04 v.09.B