False Positive Reporting

Focus Your Time and Effort on Real Threats

A false positive is normal behavior that is marked as 'different', or possibly malicious. Too many false positives can drown out true alerts. In ThreatConnect, you can easily mark an indicator as a 'false positive' when viewing the details for that indicator. This allows you and your team to focus your time and effort on real threats.