Managing false positive rules

Alerts based on rules that match harmless activity are called false positive alerts. Reviewing false positive alerts can waste valuable Administrator, Senior Analyst, and Investigator time. You can suppress false positive alerts by identifying relevant indicator of compromise (IOC) conditions and specific malware, exploit, or generic alert information. The classification is not permanent and can be removed.

The effect of false positive rules on alerts
About false positive badges
Reviewing false positive rules
Defining false positive rules
Searching for false positive rules
Removing false positive rules