Press CTRL+K to open search

Defining false positive rules on the Triage Summary page

  • Published on Sep 10, 2026
  • 1 minute(s) read
Prev Next

You can mark an indicator of compromise (IOC) or exploit (XPLT) alert as false positive in the Triage Summary page using the following procedure.

To define an IOC or XPLT alert as false positive rule on the Triage Summary page:

  1. Open a triage summary from either the Hosts page or the Acquisitions page. For more information, see Reviewing triage collections in the Triage Viewer .

  2. Select an Alerting Process in the left hand pane. An example is shown in the figure below.

    HX_TriageAlertProcess.png

  3. In the details pane on the right, click the badge for the alert condition that you want to mark as a false positive. In the example below, we have selected the Presence (PRS) alert bade.

    The Details dialog box opens.

    HX_triage_markFP.png

  4. Click Mark as false positive.

:
Related articles
  • Marking an alert as a false positive
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Managing alerts, quarantined files, and false positives > Managing alerts, quarantined files, and false positives
  • Marking an alert as a false positive
    Endpoint Detection and Response with Forensics (EDRF) > Detect and handle potential threats with EDRF > Configure EDRF to detect potential threats > Managing alerts, quarantined files, and false positives
  • Defining false positive rules on the Host Details page
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Managing alerts, quarantined files, and false positives > Managing alerts, quarantined files, and false positives > Managing false positive rules > Defining false positive rules