Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV 1 Manual page 80

74 S A
USPICIOUS CTIVITY
Step 2
Step 3
Step 4
Step 5
Step 6
O
FFENSES
In the List of Event Categories, double-click the related category to display
associated events.
Select the event that includes the known source IP address that is reported to
produce suspicious activity.
Click False Positive.
The False Positive window appears with information derived from the selected
event.
Select the necessary event properties to tune as a false positive.
For example, in the window above, the source IP address and the event high-level
category that is creating the false positive suspicious offense. For additional
information on using the False Positive tuning function, see the STRM Users
Guide.
Click Tune.
Category Offense Investigation Guide