US Patent 12061516 Determining false positive and active event data

In one example of the present disclosure, a method for determining false positive and active indications is disclosed. The method may apply anomaly network event data to a machine learning model. The machine learning model is trained with historic and correlated anomaly network event data. The method then determines which one of the anomaly network event data is a false positive indication and which one is an active indication.