>
    Strata Copilot
    Report an Incorrect Verdict
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma AIRS
    3. AI Runtime Security
    4. AI Runtime Security API Intercept
    5. False Positive/False Negative (FP/FN) Reporting and Auto Remediation
    6. Report an Incorrect Verdict
    Download PDF
    Prisma AIRS

    Report an Incorrect Verdict

    Table of Contents

    Report an Incorrect Verdict

    Report a false positive or false negative verdict from the Violations or Sessions view.
    Where Can I Use This?What Do I Need?
    • Prisma AI Runtime Security
    • Prisma AIRS AI Runtime Security license
    • AI Runtime Security deployed (network intercept or API intercept)
    When AI Runtime Security returns a wrong verdict, you can report it as a false positive (FP) — where the detector flagged benign content as a threat — or a false negative (FN) — where the detector missed a real threat. Reporting a verdict doesn't change existing scan results. To also correct future verdicts, choose Report & Create an Exception Pattern to add an exception pattern to the AI Security Profile that triggered the detection.
    Reporting is evaluated per individual detection service. You can submit reports only for detection services that are currently enabled in the associated AI Security Profile (disabled services do not return verdicts and cannot be reported).

    Report from the Violations view

    Report a false positive or false negative verdict for a detection service from the Violations view.
    You can report:
    • A false positive (FP) for an enabled detection service that returned a Malicious verdict.
    • A false negative (FN) for an enabled detection service that returned a Benign verdict.
    1. In Strata Cloud Manager, select AI SecurityAI Runtime APIAPI Violations.
    2. Next to the detection service, select a reporting action:
      • Report Only: Submits feedback on the verdict without modifying future behavior. A description is optional. Click Submit.
      • Report & Create an Exception Pattern: Submits feedback and opens the workflow to create an exception pattern that overrides future verdicts.
    3. When selecting Report & Create an Exception Pattern:
      1. Description: Explain why the verdict is incorrect. Optional, but recommended to help others tell patterns apart.
      2. Type: Select Exact Match or Regex Pattern Match.
      3. Pattern: Review and adjust the mandatory Pattern field to ensure it accurately matches the intended content.
      4. Run Test: Click Run Test to validate the pattern against the payload. The match result must turn green before you can proceed; the Submit button remains disabled until a successful test match is confirmed.
    4. Click Submit & Create Exception Pattern to save the exception pattern to the associated AI Security Profile.

    Report from the Sessions view

    Report a false positive or false negative verdict for a detection service from the Sessions view.
    The report type is determined automatically based on the service verdict:
    • A False Positive (FP) is automatically assigned when reporting a service that returned a Malicious verdict.
    • A False Negative (FN) is automatically assigned when reporting a service that returned a Benign verdict.
    1. In Strata Cloud Manager, select AI SecurityAI Runtime APIAI Sessions.
    2. Select and click the session you want to review to open the details flyout.
    3. Locate the specific detection service you want to report and click the flag icon.
    4. Select your reporting action:
      • Report Only: Click Submit to submit feedback on the verdict without creating an override rule. This action does not alter any scan results.
      • Report & Create an Exception Pattern: Submits feedback and creates an exception rule associated with the current AI Security Profile to override future scan verdicts. (Existing scan results remain unchanged.)
    5. When selecting Report & Create an Exception Pattern:
      1. Payload storage consent (FN only): For false negative reports, confirm consent to store the payload. By default, benign payloads are retained for only 14 days; granting consent keeps the payload available so you can review or update the rule later.
      2. Type: Select Exact Match or Regex Pattern Match.
      3. Pattern: Verify the pre-filled pattern and edit it if needed. Required.
      4. Run Test: Click Run Test to validate the pattern against the payload. The pattern must match. Submit stays disabled until it does.
      5. Description: Explain why the verdict is incorrect. Optional, but recommended to help others tell patterns apart.
    6. Click Submit & Create Exception Pattern to create the exception rule and attach it to the current AI Security Profile.

    © 2026 Palo Alto Networks, Inc. All rights reserved.