What does field field false positive examples do (how to use it) in an Elastic alert rule?

Elastic Security
1

In an Elastic alert rule (Security | rules) under about | advanced settings, there is a field False positive examples I've tested with 2 IP address and triggered a virus (eicar) detection rule with one of these IP adresses in the false positive example field. I did not notice any difference in result between the 2 hits on this alert rule. I've looked at the documentation, but found the documentation ([Create a detection rule | Elastic Security Solution [8.15] | Elastic]) not very helpful.

Is there somebody who knows the explaination of the working and meaning of the available fields under advanced settings in an alert rule?

2

Hey @Peter_K

This field has purely informative purpose. It does not have any effect on rule execution and number of generated alerts.
It can be used to give examples on rule details page of possible false positives, while triaging existing alerts.

For example, section False Positive Analysis for one of Elastic Security rules, gives insights in which cases alerts might be false positives

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.