Setting an Event Status to False Positive

Follow these steps to set the Status of an Event Group to False Positive, and, if desired, mark Indicators associated to the Event as false positives:

1. Navigate to the Details screen of an Event Group (Figure 1). For instructions on accessing a Group’s Details screen, see the “Viewing the Details Screen” section of The Details Screen.

   

    

2. Scroll down to the Details card on the right side of the screen (Figure 2).

   

    

3. Click the Event Group’s Status (Needs Review in Figure 2) to display the Status dropdown menu (Figure 3).

   

    

4. Select False Positive from the dropdown menu, and click Save (Figure 3). The Event Group’s Status will change to False Positive, and the Apply False Positive window will be displayed.
5. Click the YES button to mark all Indicators associated to the Event Group as false positives, if desired.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20047-04 v.08.A