How can I reduce false positives in my findings?

Tips for improving finding accuracy.
With the Nightfall Detection Engine, there are various ways you can improve the accuracy of detection:
  • Increase the minimum confidence. For example, you may be detecting results that have a confidence of “Possible” - if you increase this to “Likely” or “Very Likely” you will stop receiving detections with lower levels of probability in matching the data type. Read more about detector confidence levels in What do different “Confidence Levels” mean?
  • Increase the minimum number of findings threshold. For example, produce alerts only when seeing X number of credit card numbers.
  • Modify a Nightfall detector or custom detector with exclusion rules for known test or mock values to reduce the false-positive rate. Read more about Exclusion Rules in our Detector Glossary.
  • Modify a Nightfall detector or custom detector with context rules to set a more specific confidence level for a finding based on your unique data that surrounds the sensitive token. This can be especially effective when used in conjunction with higher minimum Confidence thresholds. Read more about Context Rules in our Detector Glossary.
  • Create a custom regex detector for your specific variant of a data type instead of using Nightfall prebuilt detectors. Read more about Custom Detectors in our Detector Glossary.
  • Notify Nightfall of your false positives to help us tune the accuracy of our detectors.
  • For Nightfall Enterprise (i.e. on Slack Enterprise plans), enable or disable detection in private channels, direct messages by channel ID, workspace ID, or in all private channels & DMs. Please reach out to [email protected] to facilitate this.