False Positive Tuning

[Racquel_Mays]

Once you have tuned a false positive in MARS.  Where can you go to view the signatures that you have tuned?  I know the "False Positive" tab only shows some of the tuned signatures, but where can I go to view all user created false positves after they are tuned?

[Farrukh Haroon]

Hello

Do you want to see the' Drop Rules' themslves or the actual false positive events as a result of those drop rules?

Regards

Farrrukh

[Farrukh Haroon]

Hello

Do you want to see the' Drop Rules' themslves or the actual false positive events as a result of those drop rules?

Regards

Farrrukh

[hegegabor]

Hi,

You can find the false positive tunings here:

routes - > drop rules.

When you create a false positive you have to select log to db or drop the events.

If you want to use this events in the future (for reports), use log to db else it will be deleted.

If the event is stored to db it not appears as an incident, cannot be used in rules, but can run a report on them.

regards

Gabor

/please vote if it helps/