When a Prisma® AIRS™ detector returns a wrong verdict, you can correct it yourself without waiting for a model retrain. A false positive (FP) flags benign traffic as a threat. A false negative (FN) misses a real threat. FP/FN reporting lets you submit incorrect verdicts from the Sessions and Violations views in Strata Cloud Manager. When you choose Report & Create an Exception Pattern, AI Runtime Security creates an exception pattern in the affected AI Security Profile.

Exception patterns are exact-match and regex pattern match rules that apply to new scans. Exception patterns override the detector's classification verdict by marking matched content as either Benign (created from FP reports to clear false alarms) or Malicious (created from FN reports to flag missed threats). The AI Security Profile then applies its configured profile action (such as Allow, Alert, or Block) based on the resulting verdict:

You can create and test exception patterns independently in ConfigurationsException Patterns before attaching them to a specific AI Security Profile's Exceptions tab. Patterns apply to all scan types (synchronous, inference hooks, and asynchronous). When a pattern overrides a verdict, the Sessions and Violations views display Exception Pattern Matched.