Press CTRL+K to open search

False positive rule types

  • Published on Sep 10, 2026
  • 1 minute(s) read
Prev Next

The following types of false positive rules are supported. These types may appear in the Rule Type column on the False Positives tab of the Rules page in the Endpoint Security (HX) Web UI.

Type

Description

IOC

Identifies a false positive rule for an indicator of compromise (IOC) condition.

EXD

Identifies a false positive rule for an exploit alert.

MAL

Identifies a false positive rule for information from a malware alert.

For information about managing false positive rules, see Managing false positive rules .

:
Related articles
  • The effect of false positive rules on alerts
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Managing alerts, quarantined files, and false positives > Managing alerts, quarantined files, and false positives > Managing false positive rules
  • Searching for false positive rules
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Managing alerts, quarantined files, and false positives > Managing alerts, quarantined files, and false positives > Managing false positive rules
  • Reviewing all false positive rules
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Managing alerts, quarantined files, and false positives > Managing alerts, quarantined files, and false positives > Managing false positive rules > Reviewing false positive rules