After reviewing all information about an alert, you can log an assessment on the alert details page.
To add an assessment to an alert:
On the alert details page, click Assess.
Select whether the alert is a True Positive or a False Positive.
If the alert is a True Positive, select a classification. Space is provided for you to enter notes.
If the alert is a False Positive, you may enter notes when you classify the alert.
Select the Close Alert checkbox if you want Helix Enterprise to close the alert when you confirm the assessment.
Click Confirm TP or Confirm FP, respectively, to submit your assessment.