A security team notices a number of anomalies under Monitor > Events. The incident response team works with the developers to determine that these anomalies are false positives. What will be the effec

Question

Options

• AThe model is deleted, and Defender will releam for 24 hours.
• BThe model is retained, and any new behavior observed during the new learning period will be
• CThe model is deleted and returns to the initial learning state
• DThe anomalies detected will automatically be added to the model.

• A
  3% (1)
• B
  91% (32)
• D
  6% (2)

Explanation

In Prisma Cloud Compute, the 'Relearn' function initiates a new learning period for the behavioral model without discarding the existing model. The existing learned behaviors are retained as a baseline, and any new behaviors observed during the relearn window are incorporated (added) into the model. This is the appropriate response to false positives caused by legitimate new behaviors - it lets the system update its understanding. Option A is incorrect because the model is not deleted. Option C is incorrect because it does not return to a blank initial state. Option D is incorrect because anomalies are not automatically added without a new learning period - Relearn triggers the process.

No community discussion yet for this question.