Technical Reference
False-positive Reduction
Tune working hours, allowlists, MFA context, and operational exceptions to reduce alert noise.
IP, user, device, and license values on this page are anonymized.
business_hours: 08:00-18:00 Europe/Istanbul allowlist: 203.0.113.0/24 suppress_when: known_admin_vpn AND mfa_success=true escalate_when: new_country=true AND failed_before_success >= 5