Press CTRL+K to open search

Defining IOC false positive rules on the Rules page

  • Published on Sep 10, 2026
  • 1 minute(s) read
Prev Next
To define an IOC false positive rule on the Rules page:

  1. Select Rules to access the Rules page.

  2. On the Indicators tab, select the indicator rule that contains the condition that you want to define as a false positive in an IOC false positive rule.

  3. In the Detail pane on the right, click the condition that you want to mark as a false positive.

    A Mark as false positive option appears above and to the right of the condition.

  4. Click Mark as false positive.

    The Mark as False Positive page appears.

  5. Configure the rule using the instructions in Marking an alert as a false positive.

    The condition remains visible on the Indicator Details pane, but is inactive. The IOC false positive rule for that condition is defined and added to the False Positives tab on the Rules page.

:
Related articles
  • Defining false positive rules on the Triage Summary page
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Managing alerts, quarantined files, and false positives > Managing alerts, quarantined files, and false positives > Managing false positive rules > Defining false positive rules
  • Rules page
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Overview > The Endpoint Security (HX) Web UI > About the Endpoint Security (HX) Web UI
  • Defining false positive rules on the Alerts page
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Managing alerts, quarantined files, and false positives > Managing alerts, quarantined files, and false positives > Managing false positive rules > Defining false positive rules