docs / security/false-positives
False positives
How ekmire handles and learns from FP reports.
Submitting a report
One-click from the event detail panel in the dashboard. The event payload hash, rule ID, and your account are sent to the rule review queue.
Review process
Flux8Labs engineers triage every FP report. Rules with FP rate > 5% are demoted or retired. You can track the status of your reports in the dashboard.
Customer impact
Demotions and retirements ship in the next bundle. No customer action required. Proxies pick up the change within 60 seconds of the next bundle push.