Microsoft Technology Licensing, LLC

Daniel Davraev

Ram Haim Pliskin

Shalom Shay Shavit

Systems and techniques for reduction of security detection false positives are described herein. Suspicious activity data is obtained for an operation. Operation data is obtained for the operation. It is determined that the operation is related to a parent operation that has not triggered an alert. The operation is cleared from the suspicious activity data.

Reduction of security detection false positives

A recovery instruction pertaining to a resource is detected. The recovery instruction is matched with a delete instruction that caused the resource to enter a soft-deleted. A mismatch between a first user account associated with the recovery instruction and a second user account associated with the delete instruction is determined. A mitigation action is performed based on determining the mismatch between the first user account and the second user account.

Growing community of inventors

Or Yehuda, Israel

Daniel Davraev