Skip to main content
Contact Us
My preferencesSign out
Proofpoint, Inc.

KB: How to Report a False Positive or False Negative

  1. Last updated
  2. Save as PDF

Login to your Proofpoint Essentials account to access help documentation and additional knowledge base articles:

 

Situation

A user has received an email that should have been quarantined (false negative).
A n email has been quarantined that should have been delivered (false positive).

Solution

Report an email to Proofpoint so that it can be reviewed and, if required, definitions can be updated. 

Report an Email

Only Administrators can follow the steps outlined below.

  1. Click Log Search.
  2. Search for the email.
  3. Expand the Actions dropdown. 

    Screenshot 2023-03-15 at 15.12.23.png
  4. Click either Report as false positive OR Report as false negative.

    Screenshot 2023-03-15 at 15.07.33.png
  5. Click Apply.
  6. Fill out any additional comments.
  7. Check the box, allowing Proofpoint Essentials access to the message.
  8. Click Report.
  9. If you have multiple, please repeat the above.

Response Time

False Positive and False Negative reports are reviewed individually by Proofpoint Threat Analysts as they are reported through the UI.  This is done with a mixture of automation and manual review. If an email is condemned, it can take up to 1 hour before our engines are updated.