Currently running Ontap 9.12.1P10 on FAS8700 and FAS 2750
We are running ARW. I have a number of volumes which experienced false positives where the attack probability was low. I ran the command to indicate a false positive and clear the alerts. The volumes do not have any ARW snapshots from the alert's time period. When I run the command "security anti-ransomware volume show" with the volume information it still shows a low level attack from the date that the false positive occurred. At the time I ran the command to clear the alert, it appeared to be successful. Does anyone know of a way to clear the alert. Below is a screen shot
![jhuber66_0-1717705832484.png jhuber66_0-1717705832484.png](https://community.netapp.com/t5/image/serverpage/image-id/28372i599F4F6B665834AC/image-dimensions/786x134?v=v2)