Mark Anomalies as Resolved

Resolving threats and anomalies on a regular basis is an important part of training Threat Protection about baseline behavior in your environment. To get a better result, your organization should resolve threats and anomalies on a regular basis. If an anomaly is identified as a security violation or a valid anomaly requiring policy changes, it should be marked resolved after the event/investigation has concluded.

1. Go to Incidents > Anomalies > Anomalies.
2. In the Anomalies table, select the specific anomaly you wish to resolve.
3. In the Anomalies Cloud Card, select Status as Resolved to remove the anomaly from the Anomalies list.
   

Once updated, a successful message is displayed at the bottom of the page.