05-04-2021 12:47 PM
I'm finding what appears to be a lot of false positives for alerts within Compute Defender > Events and Runtime. What is best practice for marking these false positive to prevent additional alerts from being generated? I noticed some options for re-learning models (e.g. Container Type), but others (e.g. Host type) appear differently.