# Deal with false positives

**URL:** <https://discuss.elastic.co/t/deal-with-false-positives/208950>\
**Category:** Endpoint Security\
**Created:** [November 21, 2019, 5:48pm UTC](https://discuss.elastic.co/t/deal-with-false-positives/208950 "2019-11-21T17:48:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![p3464782](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/p3464782/32/48475_2.png) [@p3464782](https://discuss.elastic.co/u/p3464782)\
**Post date:** [November 21, 2019, 5:48pm UTC](https://discuss.elastic.co/t/deal-with-false-positives/208950/1 "2019-11-21T17:48:30Z")

</div>

Can one overrule a triggered detection and response rule via e.g. the API, for example if a false positive is identified by my company? Or does the Kibana SIEM allows an analist to revert any automatic responses?

---

<div class="post-metadata">

**Author:** ![tonymeehan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tonymeehan/32/56524_2.png) [@tonymeehan](https://discuss.elastic.co/u/tonymeehan)\
**Post date:** [December 6, 2019, 10:00pm UTC](https://discuss.elastic.co/t/deal-with-false-positives/208950/2 "2019-12-06T22:00:59Z")

</div>

Hi, Piet -- if I understand your question correctly, yes, it's possible to whitelist alerts by hash, signer, etc. that you or your company determine to be false positives via the API. Once you take this action, we will no longer show alerts for the specific criteria you whitelisted (hash, signer, etc.). I hope that answers your question!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 3, 2020, 10:01pm UTC](https://discuss.elastic.co/t/deal-with-false-positives/208950/3 "2020-01-03T22:01:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.