Mark Anomalies as False Positive

If an anomaly represents unusual behavior that does not indicate a security incident (for example, an employee who has a new project that requires an unusual number of record downloads), that anomaly should be marked as a false positive. The information you provide to resolve anomalies trains Threat Protection on how to handle anomalies within your organization.

Anomalies can be marked as false positives by a user with Incident Handler permissions.

1. Go to Incidents > Anomalies > Anomalies.
2. In the Anomalies table, select the specific anomaly you wish to resolve.
3. In the Anomalies Cloud Card, select Status as False Positive to remove the anomaly from the Anomalies list.
   

Once updated, a successful message is displayed at the bottom of the page.