Currently running Ontap 9.12.1P10 on FAS8700 and FAS 2750
We are running ARW. I have a number of volumes which experienced false positives where the attack probability was low. I ran the command to indicate a false positive and clear the alerts. The volumes do not have any ARW snapshots from the alert's time period. When I run the command "security anti-ransomware volume show" with the volume information it still shows a low level attack from the date that the false positive occurred. At the time I ran the command to clear the alert, it appeared to be successful. Does anyone know of a way to clear the alert. Below is a screen shot
Public