Press CTRL+K to open search

Defining false positive rules on the Alerts page

  • Published on Sep 10, 2026
  • 1 minute(s) read
Prev Next

You can mark an alert as a false positive on the Alerts page. This creates a false positive rule that is then applied to other alerts matching the same criteria. To learn more about marking an alert as false positive from the Alerts page, see Marking an alert as a false positive.

:
Related articles
  • Marking an alert as a false positive
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Managing alerts, quarantined files, and false positives > Managing alerts, quarantined files, and false positives
  • Marking an alert as a false positive
    Endpoint Detection and Response with Forensics (EDRF) > Detect and handle potential threats with EDRF > Configure EDRF to detect potential threats > Managing alerts, quarantined files, and false positives
  • Defining false positive rules on the Host Details page
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Managing alerts, quarantined files, and false positives > Managing alerts, quarantined files, and false positives > Managing false positive rules > Defining false positive rules