User type: Both Personal and Organization users
The Report False Detection feature allows users to report files they feel have been wrongly flagged as malicious by an OPSWAT Product. OPSWAT's expert analyst team will review these submissions for false positives/negatives and update our Reputation Engine database as needed.
Definition of a False Detection
A false detection occurs when the verdict of a detection system does not match the actual nature of a file.
The first case is a false positive, where a benign file is incorrectly flagged as malicious. The risk here is mostly operational, since critical business tasks may be delayed. Within OPSWAT solutions, a false positive is considered any clean file detected as LIKELY_MALICIOUS or MALICIOUS.
The second case is a false negative, which occurs when a malicious sample goes undetected. These cases pose a higher security risk because they allow compromise to remain unnoticed and potentially cause significant impact. Any malware not detected as LIKELY_MALICIOUS or MALICIOUS is considered a false negative. Newly requested detection logic or file type support also falls into this category, as it highlights a missed threat under current capabilities.
A clean file flagged as SUSPICIOUS is not considered a false positive under this service. A suspicious verdict indicates that the file shows indicators warranting further review. For more details, please refer to the Sandbox verdict documentation here.
How to Report False Detection
A user can submit up to 40 False Detection reports per day. For large numbers of related files, users should compress them into a single ZIP archive and submit one report with full details in the description.
You can report false positive or false negative by submitting a report in Support > Report False Detection function and have the file analyzed by OPSWAT's expert analyst team. Follow the below steps to submit the report of the file that you think has been misidentified:
Once you submit a False Detection report, system will automatically generate a Support case showing in Support > False Detection Reports tab, allowing you to easily monitor the progress.
Submission History
Starting November 6th, Submission History tab will be merged into Support > False Detection cases
You can find history of submissions with detailed information by navigating to Support > False Detection Reports tabs.
In this tab, you can
- Search by Case number or Subject
- Filter cases by Status (Open/Closed/Waiting on me/Waiting on OPSWAT)
- View details of False Detection - "View Detection"
- Export case details to CSV for offline use.
- Access the full submission list by clicking View All button
- Submissions with statuses Confirmed Benign, Confirmed Malicious, Confirmed PUP or Rejected will have their associated files automatically removed 90 days after the submission date.
- Submissions with statuses In Queue, In Progress, or Release Pending will have their associated files removed 365 days after the submission date.
