If you suspect that a threat indicator in the Threat Intelligence database is a false positive, create a support request and explain the reasoning.
Threat Intelligence investigates the request. If the findings are conclusive, Threat Intelligence adjusts the confidence level or removes the threat indicator from the result set.
-
From the details page of the threat indicator that you searched for, click Report false positive.
-
Click Create Support Request.
-
Include the following information in the request:
- Tenancy OCID. You can find the tenancy's OCID by clicking the Profile icon in the Console header, and then clicking Tenancy: <your_tenancy_name>.
- Indicator OCID. You can find the OCID for the threat indicator on the indicator details page.
- Summary of the data quality concern.