# What does field field false positive examples do (how to use it) in an Elastic alert rule?

**URL:** <https://discuss.elastic.co/t/what-does-field-field-false-positive-examples-do-how-to-use-it-in-an-elastic-alert-rule/368129>\
**Category:** Elastic Security\
**Created:** [October 2, 2024, 12:33pm UTC](https://discuss.elastic.co/t/what-does-field-field-false-positive-examples-do-how-to-use-it-in-an-elastic-alert-rule/368129 "2024-10-02T12:33:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Peter\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peter_k/32/123676_2.png) [@Peter\_K](https://discuss.elastic.co/u/Peter_K)\
**Post date:** [October 2, 2024, 12:33pm UTC](https://discuss.elastic.co/t/what-does-field-field-false-positive-examples-do-how-to-use-it-in-an-elastic-alert-rule/368129/1 "2024-10-02T12:33:33Z")

</div>

In an Elastic alert rule (_Security | rules_) under _about | advanced settings_, there is a field _False positive examples_ I've tested with 2 IP address and triggered a virus (eicar) detection rule with one of these IP adresses in the _false positive example_ field. I did not notice any difference in result between the 2 hits on this alert rule. I've looked at the documentation, but found the documentation ([[Create a detection rule | Elastic Security Solution [8.15] | Elastic](https://www.elastic.co/guide/en/security/current/rules-ui-create.html)]) not very helpful.

Is there somebody who knows the explaination of the working and meaning of the available fields under _advanced settings_ in an alert rule?

---

<div class="post-metadata">

**Author:** ![vitaliidm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitaliidm/32/101610_2.png) [@vitaliidm](https://discuss.elastic.co/u/vitaliidm)\
**Post date:** [October 2, 2024, 1:45pm UTC](https://discuss.elastic.co/t/what-does-field-field-false-positive-examples-do-how-to-use-it-in-an-elastic-alert-rule/368129/2 "2024-10-02T13:45:21Z")

</div>

Hey @Peter_K

This field has purely informative purpose. It does not have any effect on rule execution and number of generated alerts.  
It can be used to give examples on rule details page of possible false positives, while triaging existing alerts.

For example, [section **False Positive Analysis**](https://www.elastic.co/guide/en/security/current/anomalous-process-for-a-linux-population.html) for one of Elastic Security rules, gives insights in which cases alerts might be false positives

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 30, 2024, 1:45pm UTC](https://discuss.elastic.co/t/what-does-field-field-false-positive-examples-do-how-to-use-it-in-an-elastic-alert-rule/368129/3 "2024-10-30T13:45:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.