topic ARW false positives will not clear in ONTAP Discussions https://community.netapp.com/t5/ONTAP-Discussions/ARW-false-positives-will-not-clear/m-p/453118#M43672 <P>Currently running Ontap 9.12.1P10 on FAS8700 and FAS 2750</P><P>We are running ARW.&nbsp; I have a number of volumes which experienced false positives where the attack probability was low.&nbsp; I ran the command to indicate a false positive and clear the alerts.&nbsp; The volumes do not have any ARW snapshots from the alert's time period. When I run the command&nbsp; &nbsp; "security anti-ransomware volume show" with the volume information it still shows a low level attack from the date that the false positive occurred.&nbsp; At the time I ran the command to clear the alert, it appeared to be successful.&nbsp; &nbsp; Does anyone know of a way to clear the alert.&nbsp; Below is a screen shot&nbsp;</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="jhuber66_0-1717705832484.png" style="width: 786px;"><img src="https://community.netapp.com/t5/image/serverpage/image-id/28372i599F4F6B665834AC/image-dimensions/786x134?v=v2" width="786" height="134" role="button" title="jhuber66_0-1717705832484.png" alt="jhuber66_0-1717705832484.png" /></span></P><P>&nbsp;</P> Thu, 06 Jun 2024 20:31:28 GMT jhuber66 2024-06-06T20:31:28Z ARW false positives will not clear https://community.netapp.com/t5/ONTAP-Discussions/ARW-false-positives-will-not-clear/m-p/453118#M43672 <P>Currently running Ontap 9.12.1P10 on FAS8700 and FAS 2750</P><P>We are running ARW.&nbsp; I have a number of volumes which experienced false positives where the attack probability was low.&nbsp; I ran the command to indicate a false positive and clear the alerts.&nbsp; The volumes do not have any ARW snapshots from the alert's time period. When I run the command&nbsp; &nbsp; "security anti-ransomware volume show" with the volume information it still shows a low level attack from the date that the false positive occurred.&nbsp; At the time I ran the command to clear the alert, it appeared to be successful.&nbsp; &nbsp; Does anyone know of a way to clear the alert.&nbsp; Below is a screen shot&nbsp;</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="jhuber66_0-1717705832484.png" style="width: 786px;"><img src="https://community.netapp.com/t5/image/serverpage/image-id/28372i599F4F6B665834AC/image-dimensions/786x134?v=v2" width="786" height="134" role="button" title="jhuber66_0-1717705832484.png" alt="jhuber66_0-1717705832484.png" /></span></P><P>&nbsp;</P> Thu, 06 Jun 2024 20:31:28 GMT https://community.netapp.com/t5/ONTAP-Discussions/ARW-false-positives-will-not-clear/m-p/453118#M43672 jhuber66 2024-06-06T20:31:28Z