What's the proper procedure of filtering false positives from ioc, boc, eoc

[Anonymous]

Going through the behaviour, indicator and enabler of compromises I have a lot of false positives.

What's the correct procedure for filtering those false positives so I'm not jumping at shadows every day?

[BaptOnfroy]

Hi Jeremy,

You have to edit App Rules in your decoder to make whitelist on false positives

Regards,