# We get too many false positives. How do we tune without missing real attacks?

Tune narrowly and keep a record: exclude a specific known activity on a specific host, never a whole type of alert across the network. Start with the alerts that recur most. For each, confirm what causes it, for example the backup server copying to the storage system every night, and mark that exact behaviour as expected, ideally with the host, destination and time window. Leave the rest of the detection untouched, so the same pattern from any other host still alerts. Write down who decided and why, and review exclusions every few months, because a forgotten exception is a place for an attacker to hide. Test after tuning: run a harmless scan or a test call-out and check that it still raises an alert. In NetSenX you mark false positives on the alerts themselves and every decision is kept in the audit log, and the false-positive bound is shown only once your labelled data supports it.

FAQ: [Budget, staff and alert noise](https://netsenx.com/en/faq/budget) · https://netsenx.com/en/faq/how-to-tune-false-positives-without-missing-real-attacks

## Read next

- https://netsenx.com/en/pricing
- https://netsenx.com/en/ndr-for-small-business

## Related questions

- [How long until a new security tool stops being noisy?](https://netsenx.com/en/faq/how-long-until-a-new-security-tool-is-quiet)
- [How much time does a small team need to run NDR?](https://netsenx.com/en/faq/how-much-time-does-a-small-team-need-to-run-ndr)
- [How much should a small business spend on cyber security?](https://netsenx.com/en/faq/how-much-should-a-small-business-spend-on-cyber-security)
- [What security spending should a small company never cut?](https://netsenx.com/en/faq/what-security-spending-should-a-small-company-never-cut)
- [How do I calculate the cost of one day of IT downtime?](https://netsenx.com/en/faq/how-to-calculate-the-cost-of-one-day-of-it-downtime)