False Positive Management
Introduction
Ransomware Defender gives you a few complementary tools to manage false positives. They differ in scope, precision, and how they interact with the detection pipeline: Learned Thresholds, the Ignored List, and Monitor Only.
These work alongside the per-extension Monitor Only state described in Well Known Extension List — that page covers disabling or monitoring a specific file extension across the environment; this page covers managing false positives for a specific user, path, or IP.
| Tool | Scope | Detection still runs? | Events raised? | Learning? |
|---|---|---|---|---|
| Learned Thresholds | Per user, path, or group | Yes | Harder to trigger | Yes — via event closure |
| Ignored List | Per path / user / IP | No — events dropped before processing | No | No |
| Monitor Only | Per path / user / IP | Yes | No | No |
The recommended order to reach for these tools
Start with Learned Thresholds. This is the primary mechanism for false positive management and should be your first response in almost every case. It suppresses known-safe activity without creating gaps in your detection coverage — the system keeps watching and keeps building a more accurate picture of your environment over time.
Use Monitor Only when you need to protect specific entities from lockout — but only while operating in Enforcement or Critical mode. Monitor Only is the right tool when you have a path, user, or IP that you know will trigger detections due to legitimate high-volume activity, and you cannot yet have that entity locked out. Events for Monitor Only entries are still detected, still raised, and still visible on the Threat Detections page as warnings — you retain full visibility.
Use the Ignored List only as a last resort. Adding any path, user, or IP to the Ignored List removes it entirely from the detection pipeline — no events are raised, no activity is logged for detection purposes, no blind spot is visible on the Threat Detections page. The Ignored List is appropriate for paths containing genuinely non-critical data that can be easily recreated (for example, temp directories or scratch paths), or for known automation accounts on fully isolated segments where the operational cost of false positives cannot be managed any other way.
Key principle: Learned Thresholds suppresses known-safe behavior while keeping detection active. Ignored List removes detection entirely. When in doubt, use Learned Thresholds first.
Learned Thresholds
The Learned Thresholds tab displays threshold multiplier overrides that adjust detection sensitivity for specific users, paths, or groups. Instead of changing the global Signal Strength thresholds, a multiplier scales the required threshold specifically for that entry — for example, a 2.0x multiplier on a path means twice as many events must occur on that path before a detection fires.
Columns:
| Column | Description |
|---|---|
| Entry | Path, user SID, or group identifier the threshold applies to. |
| SID | Active Directory SID of the associated user or group, if applicable. |
| Threat Detector | Which specific detector this threshold modifies (for example: Mass Delete, Suspicious Extension). |
| Multiplier | How much the standard threshold is scaled (for example: 1.8x means 80% more activity is required to fire). |
How entries are created
Learned Thresholds entries are created in two ways:
- Automatically — when you close an event as False Positive through the Close Event wizard and select a learning scope (this user, this path, this group, or all users). The system creates or updates the relevant entry here.
- Manually — you can create entries directly in this tab if you know in advance that a specific user or path operates at higher-than-typical volume.
Managing entries
Use Search entries to filter by path or user. Click the trash icon to delete an entry.
Caution: Deleting a learned threshold restores standard detection sensitivity for that entry. If the entry was suppressing a known false positive, similar events will be raised again after deletion.
Applying a learned threshold beyond a single user
By default, flagging an event as a false positive updates the Learned Thresholds entry for the current user only. To apply the new threshold more broadly — to a user group, globally across all users, or to a specific path — the generic threshold feature must first be enabled from the CLI:
igls rsw genericthresholds set --enabled=true
Once enabled, the Take an Action → Archive as False Positive workflow presents four scope options instead of just the current user:
| Scope | Effect |
|---|---|
| Current user | Same as the default behavior — updates the threshold for this user only. |
| Selected user groups | Applies the new threshold to every user in the selected AD group(s). |
| All users (global) | Applies the new threshold across the entire environment. A confirmation warning is shown before applying, given the scope of impact. |
| Selected path | Applies the new threshold to the chosen path regardless of which user triggers future events there. |
If the selected path (or user/group) already has an existing multiplier, you are prompted to either use the existing multiplier (archives the event without changing the multiplier) or expand it (increases the multiplier using the same calculation as a normal learning event). If other active events share signals under the same path, they are listed so you can choose whether to archive them at the same time — any not selected remain active and are not factored into the new multiplier.
New or updated entries from any of these scopes appear in the Learned Thresholds tab alongside per-user entries.
The genericthresholds setting lives in the Eyeglass appliance's own configuration (/opt/superna/sca/data/system.xml), not on the managed cluster, so this procedure is the same on VAST, Qumulo, and PowerScale.
Ignored List
The Ignored List configures paths, users, and source IPs that are completely excluded from ransomware detection. Events matching any entry are dropped before processing — no Signal Strength accumulates, no event is raised, no alert is sent.
Navigate to Detection Controls → Ignored List.
Use for: Paths containing genuinely non-critical data that can be easily recreated (for example, temp directories or scratch paths), or known automation accounts on fully isolated segments where the operational cost of false positives cannot be managed any other way. Use only as a last resort.
Do not use for: Paths containing sensitive data where you still need visibility. Use Monitor Only instead.
Adding an entry
- Click Add + in the top-right corner.
- Select the type: Path, User, or Source/Client IP.
- Enter the value:
- Path: The full path on the storage system.
- User (AD):
domain\useridoruser@domainname. Domain must be uppercase. - Source/Client IP: IP address of a client machine or server.
- Select the Managed Device this rule applies to.
- Save.
Matching logic: Each column (path, user, source IP) is evaluated with OR logic. If any ignore value matches an event, the event is dropped at the first match found.
Converting to Monitor Only
To move existing Ignored List entries to Monitor mode in bulk instead of deleting and re-adding them one at a time, use the Eyeglass CLI command documented in Convert Ignored List to Monitor-Only List. All existing Ignored List entries are deleted and moved to Monitor mode.
Monitor Only
The Monitor Only list configures paths, users, and sources where activity is processed and detection runs normally, but any resulting event is raised in Monitor mode: it appears on the Threat Detections page like any other event, snapshots are still taken, and no automatic lockout occurs — an administrator can still apply a manual lockout if needed. Unlike the Ignored List, which drops matching events before they're processed at all, Monitor Only entries still flow through the full detection pipeline; visibility without automatic enforcement is the point.
Navigate to Detection Controls → Monitor Only.
Use for: Paths or users where you want full audit visibility but are not yet ready for automated enforcement. Useful during initial deployment, for trusted service accounts, or for activity you want to observe before deciding whether to fully ignore or fully enforce.
Adding an entry
The process is identical to the Ignored List. Click Add +, select Path or User, enter the value, select the managed device, and save.
See also
- Well Known Extension List — Per-Extension State — Enable, disable, or set Monitor Only for a specific file extension across the environment.
- Lockout Settings — How SMB and NFS lockout work on VAST and Qumulo, which Monitor Only and the Ignored List let you avoid triggering.
- Active Auditor — Configure the triggers and thresholds that drive detection, upstream of the false positive tools on this page.
- Eyeglass CLI Commands — Ransomware CLI Commands — CLI reference, including converting the Ignored List to Monitor Only in bulk.