# False Positives in the 1000's **URL:** \ **Category:** SIEM\ **Created:** [September 23, 2021, 4:48pm UTC](https://discuss.elastic.co/t/false-positives-in-the-1000s/285019 "2021-09-23T16:48:30Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![tanner8302](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tanner8302/32/94038_2.png) [@tanner8302](https://discuss.elastic.co/u/tanner8302)\ **Post date:** [September 23, 2021, 4:48pm UTC](https://discuss.elastic.co/t/false-positives-in-the-1000s/285019/1 "2021-09-23T16:48:30Z")
Has anyone noticed a "HUGE" amount of false positives that occur when enabling the Detection Rule [Threat Intel Filebeat Module Indicator Match]. This rule is tagged as follows Continuous Monitoring Elastic Elastic Endgame Monitoring Network SecOps Windows I don't have Elastic Endgame, I just have the free elastic security endpoint agent. I am wondering if this detection rule, requires Endgame and this is why I am getting so many false positives??? ---
**Author:** ![n2x4](https://avatars.discourse-cdn.com/v4/letter/n/3e96dc/32.png) [@n2x4](https://discuss.elastic.co/u/n2x4)\ **Post date:** [September 23, 2021, 11:31pm UTC](https://discuss.elastic.co/t/false-positives-in-the-1000s/285019/2 "2021-09-23T23:31:55Z")
If you're getting detections for datasources you're not ingesting I'd be curious to see what events triggered the alert. There was a recent thread discussing the threat intel module alerts and the consensus is to remove the indexes you're not using or break them into smaller/separate alerts. I can say I haven't seen any FPs from my rule, FWIW. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 21, 2021, 11:32pm UTC](https://discuss.elastic.co/t/false-positives-in-the-1000s/285019/3 "2021-10-21T23:32:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.