You can remove a false positive rule using the Alerts page, the Host Details page, or the False Positives tab on the Rules page.
Note
If you need to find a false positive rule, see Searching for false positive rules.
Prerequisites
Admin, Senior Analyst, or Investigator access