topic Re: Managing Compute Defender False Positives? in Prisma Cloud Discussions

Managing Compute Defender False Positives?

CGoff12 — Tue, 04 May 2021 19:47:00 GMT

I'm finding what appears to be a lot of false positives for alerts within Compute Defender > Events and Runtime. What is best practice for marking these false positive to prevent additional alerts from being generated? I noticed some options for re-learning models (e.g. Container Type), but others (e.g. Host type) appear differently.

Re: Managing Compute Defender False Positives?

AKing9 — Fri, 12 Aug 2022 14:20:08 GMT

Greetings CGoff12,

I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.

Kind Regards,

J. Avery King

Re: Managing Compute Defender False Positives?

USheikh — Thu, 08 Sep 2022 00:37:11 GMT

Hi CGoff12,

For false positive, please use the troubleshooting section to verify the accuracy of Prisma Cloud scan results:

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/vulnerability_management/troubleshoot_vuln_detection

If you are convinced about the false positives, you can set a cve exception by following the docs below:
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/vulnerability_management/vuln_management_rules

Please let me know if you have any questions about it.

Regards,

Umer Sheikh