Tuning False Positives

You can prevent false positive flows from creating offenses. You can tune false positive flows from the flow list or flow details page.

You must have appropriate permissions for creating customized rules to tune false positives.

1. Click the Network Activity tab.
2. Optional. If you are viewing flows in streaming mode, click the Pause icon to pause streaming.
3. Select the flow that you want to tune.
4. Click False Positive.
5. In the Event/Flow Property pane on the False Positive page, select one of the following options:

   • Event/Flow(s) with a specific QID of <Event>

   • Any Event/Flow(s) with a low-level category of <Event>

   • Any Event/Flow(s) with a high-level category of <Event>

6. In the Traffic Direction pane, select one of the following options:

   • <Source IP Address> to <Destination IP Address>

   • <Source IP Address> to any Destination

   • Any Source to <Destination IP Address>

   • Any Source to any Destination

7. Click Tune.