How do I stop backup jobs from triggering security alerts?
Mark that exact job as expected, rather than switching off the detection: the backup server, its destination and its time window, nothing broader. A nightly backup moves a lot of data, often to an outside storage provider, which looks like data theft to any tool that watches volumes. The first time it alerts, confirm it is the backup: check the host, the destination and the schedule against your backup software. Then mark that alert as a false positive in NetSenX, so similar alerts from that job are recognised. Keep the detection on for every other host: the same transfer from a workstation, or from the backup server to a new destination, should still raise an alert, because attackers also copy data out at night. Write down the decision and review it when the backup setup changes. NetSenX keeps each decision in the audit log, so you can show later why an alert was closed.