Press CTRL+K to open search

Removing false positive rules using the Rules page

  • Published on Sep 10, 2026
  • 1 minute(s) read
Prev Next
To remove a false positive rule using the False Positives tab of the Rules page:

  1. Select Rules to access the Rules page.

  2. Select the False Positives tab.

  3. Select the false positive rule that you want to remove.

  4. In the detail pane on the right, click the false positive rule.

  5. Click Undo False Positive.

    The Undo False Positive page appears.

    HX_FPUndo.png

  6. Optionally, click Export Undo False Positive Alert Details to export the details about the false positive rule removal to a CSV file.

  7. On the Undo False Positive page, click Confirm.

    The false positive rule is removed.

    Note

    You cannot remove part of a false positive rule. If you need to remove a single condition from a false positive rule that includes multiple conditions, remove the whole rule and then recreate it with only the conditions you need.

:
Related articles
  • Removing false positive rules using the Alerts page
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Managing alerts, quarantined files, and false positives > Managing alerts, quarantined files, and false positives > Managing false positive rules > Removing false positive rules
  • Removing false positive rules using the Host Details page
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Managing alerts, quarantined files, and false positives > Managing alerts, quarantined files, and false positives > Managing false positive rules > Removing false positive rules
  • Marking an alert as a false positive
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Managing alerts, quarantined files, and false positives > Managing alerts, quarantined files, and false positives