mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-15 06:47:21 +00:00
Update defender-endpoint-false-positives-negatives.md
This commit is contained in:
parent
4dce3eb748
commit
37c3f85356
@ -31,16 +31,17 @@ ms.custom: FPFN
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146806)
|
||||
|
||||
In endpoint protection, a false positive is an entity, such as a file or a process, that was detected and identified as malicious, even though the entity isn't actually a threat. A false negative is an entity that was not detected as a threat, even though it actually is malicious. False positives/negatives can occur with any threat protection solution.
|
||||
In endpoint protection solutions, a false positive is an entity, such as a file or a process, that was detected and identified as malicious, even though the entity isn't actually a threat. A false negative is an entity that was not detected as a threat, even though it actually is malicious. False positives/negatives can occur with any threat protection solution, includling [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection).
|
||||
|
||||
If you’re using [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection), and you're seeing false positives/negatives in your [Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use), your security operations can take steps to address false positives or false negatives. These steps include:
|
||||
Fortunately, steps can be taken to address and reduce these kinds of issues. If you're seeing false positives/negatives in your [Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use), your security operations can take steps to address false positives or false negatives:
|
||||
|
||||
1. [Reviewing and classifying alerts](#part-1-review-and-classify-alerts)
|
||||
2. [Reviewing remediation actions that were taken](#part-2-review-remediation-actions)
|
||||
3. [Reviewing and defining exclusions](#part-3-review-or-define-exclusions)
|
||||
4. [Submitting an entity for analysis](#part-4-submit-a-file-for-analysis)
|
||||
5. [Reviewing and adjusting your threat protection settings](#part-5-review-and-adjust-your-threat-protection-settings)
|
||||
6. [Getting help if you still have issues with false positives/negatives](#still-need-help)
|
||||
1. [Review and classify alerts](#part-1-review-and-classify-alerts)
|
||||
2. [Review remediation actions that were taken](#part-2-review-remediation-actions)
|
||||
3. [Review and define exclusions](#part-3-review-or-define-exclusions)
|
||||
4. [Submit an entity for analysis](#part-4-submit-a-file-for-analysis)
|
||||
5. [Review and adjust your threat protection settings](#part-5-review-and-adjust-your-threat-protection-settings)
|
||||
|
||||
And, you can [get help if you still have issues with false positives/negatives](#still-need-help) after performing the tasks described in this article.
|
||||
|
||||
> [!NOTE]
|
||||
> This article is intended as guidance for security operators and security administrators who are using [Microsoft Defender for Endpoint](microsoft-defender-advanced-threat-protection.md).
|
||||
|
Loading…
x
Reference in New Issue
Block a user