Close false-positive alerts

The Alert Triage Worker reviews your open and acknowledged alerts and finds the ones it judges to be false positives. Its autonomy controls what it does with them.

  • With Manual autonomy (the default), the Worker proposes closing the false positives and waits for you to review and approve or decline each proposed closure.
  • With Supervised autonomy, the Worker closes the false positives on its own. You check its closures afterward and reopen any that you disagree with.

By default, the Alert Triage Worker runs every 15 minutes and triages alerts of every severity. It proposes closing an alert only when it's at least 85% confident that the alert is a false positive. It tags alerts with a lower score az:inconclusive and leaves them open for you to triage.

The Worker groups false positives from the same rule that share a pattern into one proposed action. For example, if a backup agent on many hosts runs from the same folder, with the same publisher signature and the same parent process, its alerts become one proposed action.

To change how often the Worker runs, which alerts it triages, or how confident it must be before it proposes a closure, refer to Configure Worker settings.

Open the proposed closure on the Proposed actions page, and check that the reasoning holds for every alert in the batch. Start with how many alerts the closure covers, which rule they came from, and which hosts and users they involve. A host or user you don't expect for that rule is a reason to look closer. The Worker also adds a note to each alert that explains why it judged the alert a false positive, so look for a note whose reasoning doesn't match what the alert shows.

You decide the batch as a whole. If some alerts need a closer look, ask in the investigation's chat to remove them from the closure, or decline the closure and handle the alerts one by one.

After you review a closure, approve or decline it.

  • If you approve: The alerts close as false positives. The closure runs under your account, so you need the privileges to close alerts. Without them, the closure fails.
  • If you decline: The alerts stay open, tagged az:inconclusive. The same happens if the proposed action expires before anyone decides.
Important

You can't change your decision on a proposed closure. If you approve one by mistake, reopen its alerts. Until you do, the Attack Discovery Worker skips them, so it might miss part of an attack.

Check closures regularly, especially soon after your team switches the Alert Triage Worker to Supervised autonomy.

Closed Actions on the Proposed actions page lists decisions from the last 72 hours, with the evidence behind each one. A closure that the Worker made on its own names the Worker.

If you disagree with a closure, reopen its alerts on the Alerts page, where you can also find alerts from older closures. The Attack Discovery Worker then considers the reopened alerts again.