Technical Reference

False-positive Reduction

Tune working hours, allowlists, MFA context, and operational exceptions to reduce alert noise.

IP, user, device, and license values on this page are anonymized.

business_hours: 08:00-18:00 Europe/Istanbul
allowlist: 203.0.113.0/24
suppress_when: known_admin_vpn AND mfa_success=true
escalate_when: new_country=true AND failed_before_success >= 5

Let us design your deployment plan

Let’s plan the right architecture for your FortiGate, Wazuh, and log pipelines together.

Contact us
False-positive Reduction | Documentation | Bivoxy