Two methods for avoiding false positives: Automation rules create exceptions without modifying analytics rules. Scheduled analytics rules modifications permit more detailed and permanent exceptions. https://learn.microsoft.com/en-us/azure/sentinel/false-positives