https://community.cisco.com/t5/security-analytics/sna-removing-false-positives/m-p/5547578#M1281 <P>We are getting alarms related to the "UDP Received" security event. After checking the flows, it is Microsoft Teams traffic the one triggering the security event. Is it possible to turno of this security event for traffic using a specific set of ports? I normally create role policies where I turn off alarming for the hostgroup or IPs causing the event, but in this case I want to keep the security event enabled to alarm for other traffic than Teams.</P><P>Regards.&nbsp;</P> Thu, 23 Apr 2026 07:56:49 GMT Antonio Macia 2026-04-23T07:56:49Z https://community.cisco.com/t5/security-analytics/sna-removing-false-positives/m-p/5547578#M1281 <P>We are getting alarms related to the "UDP Received" security event. After checking the flows, it is Microsoft Teams traffic the one triggering the security event. Is it possible to turno of this security event for traffic using a specific set of ports? I normally create role policies where I turn off alarming for the hostgroup or IPs causing the event, but in this case I want to keep the security event enabled to alarm for other traffic than Teams.</P><P>Regards.&nbsp;</P> Thu, 23 Apr 2026 07:56:49 GMT https://community.cisco.com/t5/security-analytics/sna-removing-false-positives/m-p/5547578#M1281 Antonio Macia 2026-04-23T07:56:49Z