Managing Compute Defender False Positives?

[CGoff12]

I'm finding what appears to be a lot of false positives for alerts within Compute Defender > Events and Runtime. What is best practice for marking these false positive to prevent additional alerts from being generated? I noticed some options for re-learning models (e.g. Container Type), but others (e.g. Host type) appear differently.

[AKing9]

Greetings CGoff12,

I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.

Kind Regards,

J. Avery King

[USheikh]

Hi CGoff12,

For false positive, please use the troubleshooting section to verify the accuracy of Prisma Cloud scan results:

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/vulnerability_manag...

If you are convinced about the false positives, you can set a cve exception by following the docs below:
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/vulnerability_manag...

Please let me know if you have any questions about it.

Regards,

Umer Sheikh