Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Tuning False Positives

 

You can use the False Positive Tuning function to prevent false positive flows from creating offenses. You can tune false positive flows from the flow list or flow details page.

Note

You can tune false positive flows from the summary or details page.

You must have appropriate permissions for creating customized rules to tune false positives.

  1. Click the Network Activity tab.
  2. Optional. If you are viewing flows in streaming mode, click the Pause icon to pause streaming.
  3. Select the flow that you want to tune.
  4. Click False Positive.
  5. In the Event/Flow Property pane on the False Positive window, select one of the following options:
    • Event/Flow(s) with a specific QID of <Event>

    • Any Event/Flow(s) with a low-level category of <Event>

    • Any Event/Flow(s) with a high-level category of <Event>

  6. In the Traffic Direction pane, select one of the following options:
    • <Source IP Address> to <Destination IP Address>

    • <Source IP Address> to any Destination

    • Any Source to <Destination IP Address>

    • Any Source to any Destination

  7. Click Tune.