> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/detection-engineering-and-threat-intelligence/false-positive-management.md).

# False positive management

Learn how Cortex XDR reduces false positives with baselining, case grouping, and exceptions.

Cortex XDR reduces false positives in two ways. Built-in mechanisms tune detections automatically, and exception rules let you suppress or allow specific activity.

### Built-in false-positive reduction

* **Behavioral baselining:** Analytics detectors learn normal behavior for each user, host, and network, and continue to adapt as your environment changes.
* **Grouping:** Related issues are grouped into a single case with their causality chain. Analysts review one story instead of many separate alerts. See [Case grouping](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/case-concepts/case-grouping) and [What is Causality?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/case-concepts/what-is-causality).
* **Content updates:** Palo Alto Networks continuously tunes detection content and delivers it in content updates.

### Choose an exception mechanism

| Goal                                                     | Mechanism                                 | Effect                                                                                                                        |
| -------------------------------------------------------- | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| Hide matching issues from cases, issue views, and search | **Issue exclusion**                       | Issues are suppressed. Logs are kept. Can be applied to historical issues.                                                    |
| Stop a specific IOC or BIOC from matching                | **IOC/BIOC exception**                    | Exclude by process hash, name, path, signer, user, or command line, for all rules or selected rules. Wildcards are supported. |
| Stop agent prevention for a trusted file or process      | **Disable Prevention rule**               | Skips prevention actions for selected modules. Issues can still be raised.                                                    |
| Temporarily bypass a process                             | **Disable Injection and Prevention rule** | Bypass for up to 48 hours                                                                                                     |
| Allow-list by path, signer, or module-specific criteria  | **Legacy agent exception**                | Applies to selected profiles                                                                                                  |
| Apply a fix from Palo Alto Networks Support              | **Support exception rule**                | Import the JSON file from Support                                                                                             |
| Allow or block a file everywhere                         | **Allow list or block list** (hash)       | Overrides the verdict                                                                                                         |

All endpoint exceptions are managed from **Settings** → **Exception Configuration**. See [Exception configuration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/exception-configuration), [Issue exclusions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/issue-exclusions), and [Add an IOC or BIOC rule exception](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-an-ioc-or-bioc-rule-exception).

{% hint style="info" %}
Choose the narrowest mechanism that solves the problem. An issue exclusion hides results but doesn't stop the agent from acting. A Disable Prevention rule stops the agent from blocking.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/detection-engineering-and-threat-intelligence/false-positive-management.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.