02-11-2011 05:57 PM
Once you have tuned a false positive in MARS. Where can you go to view the signatures that you have tuned? I know the "False Positive" tab only shows some of the tuned signatures, but where can I go to view all user created false positves after they are tuned?
02-19-2011 11:17 PM
Hello
Do you want to see the' Drop Rules' themslves or the actual false positive events as a result of those drop rules?
Regards
Farrrukh
02-19-2011 11:17 PM
Hello
Do you want to see the' Drop Rules' themslves or the actual false positive events as a result of those drop rules?
Regards
Farrrukh
02-23-2011 07:31 AM
Hi,
You can find the false positive tunings here:
routes - > drop rules.
When you create a false positive you have to select log to db or drop the events.
If you want to use this events in the future (for reports), use log to db else it will be deleted.
If the event is stored to db it not appears as an incident, cannot be used in rules, but can run a report on them.
regards
Gabor
/please vote if it helps/
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide