Viewing and Reporting False Positives

Follow the steps in this article to access view and report false positives for an Indicator on its Details screen.

New Details Screen

1. Navigate to the Details screen for an Indicator.
2. On the Overview tab, scroll down to view the Observations, False Positives & Impressions card on the right side of the screen (Figure 1). False-positive data are displayed in the following sections on the card:
   • Local Instance: The False Positives subsection displays false-positive data derived from your local ThreatConnect instance, including the total number of times the Indicator was reported as a false positive, the date when it was last reported as a false positive, and false positives reported by API users in your Organization.
   • Global CAL™: The Daily False Positives chart represents the number of times the Indicator was reported as a false positive day by day across all ThreatConnect instances opted in to CAL. The False Positives subsection displays false-positive data derived from CAL, including the date when the Indicator was last reported as a false positive, the total number of times it was reported as a false positive, and the number of times it was reported as a false positive in the last 7 days.

   

    

3. To report the Indicator as a false positive, select the Report False Positive checkbox at the top right of the Local Instance section. After you select this checkbox, a View Details button will be displayed below the Report False Positive checkbox, an updated false-positive count will be displayed next to Reported, and the current date will be displayed next to Last Reported (Figure 2).

   

    

4. Click the View Details button to display the False Positive List window, which provides a list of users who reported false positives and the dates on which the false positives were reported (Figure 3). If desired, click Deleteto delete a false-positive report.

   

    

Legacy Details Screen

1. Navigate to the legacy Details screen for an Indicator.
2. On the Overview tab, scroll down to the Observations/False Positivescard on the right side of the screen (Figure 4). False-positive data are displayed in the following sections on the card:
   • False Positives Reported: The number of times the Indicator has been reported as a false positive.
   • Last Reported: The most recent date when the Indicator was reported as a false positive.
   • API User Table: The table at the bottom of the card displays false positives reported by API users and the most recent date when they reported the Indicator as a false positive.
   

    

3. To report the Indicator as a false positive, select the Report False Positive checkbox. After you select this checkbox, an updated false-positive count and a View Details link will be displayed next to False Positives Reported, and the current date will be displayed next to Last Reported (Figure 5).

   

    

4. Click the View Details link to display the False Positive List window, which provides a list of users who reported false positives and the dates on which the false positives were reported (Figure 6). If desired, click Deleteto delete a false-positive report.

   

    

ThreatConnect^® is a registered trademark, and CAL™ is a trademark, of ThreatConnect, Inc.

20047-02 v.09.A