mark_alert_false_positive
Mark selected alerts as false positives to suppress noise. Sets status to Completed and adds a 'False positive' tag for clear tracking.
Instructions
Mark one or more alerts as a false positive (sets status=Completed and adds a 'False positive' tag). server: which configured server to target (default active/default).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| server | No | ||
| alert_ids | Yes | ||
| observation | No | Confirmed false positive |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |