SOC Workbench

False Positive ManagementNew

A dedicated false positive management module with a rules engine and background suppression service — letting analysts create targeted suppression rules that automatically silence known-good alerts across every connected source, permanently reducing noise without losing visibility.

Get a Demo Login to App

False Positive Management

Suppress alert noise. Amplify real signal.

What it does

Key capabilities

Rules Engine

Create suppression rules with field matching (title, severity, source), operators (contains, equals, starts with), and optional expiry dates.

Background Suppression Service

The hakware_fp_service runs hourly, evaluating every new alert against active rules and auto-suppressing matches — no manual action required.

Suppression Dashboard

See total active rules, permanent vs temporary rules, suppression counts per rule, and recently auto-suppressed alerts.

Temporary Rules with Expiry

Set expiry dates on rules for time-bounded suppressions — temporary deployments, maintenance windows, vendor fixes in progress.

Audit Log

Every suppression action is recorded in the FP Audit Log — who created the rule, when it fired, and which alert was suppressed.

Per-Source Statistics

Breakdown of FP suppression activity by source type to identify which integrations produce the most noise.

Highlights

Why False Positive Management?

  • Rules engine with field/operator/value matching across all sources
  • Background service auto-suppresses matching alerts hourly
  • Permanent and time-bounded suppression rules
  • Full audit log of every automated suppression action
  • Integrates with Alert Triage Queue dispositions
Request Demo Talk to us
Included in OneView

False Positive Management is part of the Hakware OneView platform. All findings, events, and data from this module flow into your central dashboard alongside every other security signal in your environment.

24/7 Support Available
Phone: +27 060 984 1210
FAQs

Frequently asked questions

The hakware_fp_service runs on an hourly schedule against all new alerts in the platform. For each alert, it evaluates every active suppression rule in sequence — checking whether the alert's source, title, severity, and other fields match the rule's conditions. Matching alerts are automatically suppressed and recorded in the FP Audit Log without analyst intervention.

Suppression rules support three matching operators per field: Contains (the field value includes the specified string), Equals (exact match required), and Starts With (the field value begins with the specified string). Rules can match on alert title, source module, severity level, or any other indexed alert field — enabling precise or broad suppression as needed.

Temporary rules include an expiry date and are deactivated automatically when the date passes. They are designed for time-bounded scenarios — a vulnerability scanner running a scheduled scan producing expected alerts, a maintenance window generating firewall policy violations, or a vendor fix in progress that will resolve the underlying alert source.

By systematically suppressing known-good alert patterns, the signal-to-noise ratio in your Event Manager and Alert Triage Queue improves continuously. Analysts spend less time on repetitive false positives, and the per-source statistics in the FP dashboard identify which integrations produce the most noise — informing decisions about vendor configuration tuning.

Related modules

Alert Triage QueueNew

Unified analyst inbox for every security alert

Learn more

Threat HuntingNew

Proactive threat hunting across your entire environment

Learn more

Asset Security ViewNew

Per-device security posture at a glance

Learn more

See False Positive Management in action

Request a personalised demo and we'll show you exactly how False Positive Management works within your environment.

Request Free Demo All Modules