If a volume contains unique or new file extensions that have not been seen before, ARP may flag these as suspicious, leading to false positives. The configuration of ARP detection parameters significa...If a volume contains unique or new file extensions that have not been seen before, ARP may flag these as suspicious, leading to false positives. The configuration of ARP detection parameters significantly impacts the frequency of false positives. Parameters such as the Detection only based on Never Seen before File Extension, threshold for new file extensions, high entropy data rates, and file operation surges can be adjusted to better suit the specific workload and reduce false positives.
