> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# False Positive Elimination

> Automatic identification and filtering of false security findings

CodeThreat's AI automatically analyzes violations to identify and filter false positives, reducing alert fatigue and allowing you to focus on real security issues.

## How False Positive Elimination Works

False Positive Elimination is the only agentic feature that works after deterministic SAST analysis. It processes deterministic SAST findings:

```mermaid theme={null}
flowchart LR
    A[Deterministic<br/>SAST Scan] --> B[SAST Findings]
    B --> C[False Positive<br/>Elimination Agent]
    C --> D{AI Checks<br/>Context}
    D -->|Safe| E[Filter Out<br/>False Positive]
    D -->|Exploitable| F[Keep<br/>Real Issue]
    D -->|Uncertain| G[Flag for<br/>Review]
    
    style A fill:#9449FE,stroke:#6627F9,color:#fff
    style B fill:#9449FE,stroke:#6627F9,color:#fff
    style C fill:#6627F9,stroke:#9449FE,color:#fff
    style F fill:#6627F9,stroke:#9449FE,color:#fff
```

**Note**: False Positive Elimination only works on deterministic SAST results. SCA, Secrets Detection, and IaC Security findings use deterministic CVE matching and pattern detection, so they don't need filtering.

**Other agentic features** (Agentic SAST, PR Reviews) are separate capabilities that don't depend on deterministic scanning.

***

## Enable False Positive Elimination

<Steps>
  <Step title="Open Repository Settings">
    **Repository Settings** → **AI Features**
  </Step>

  <Step title="Enable FP Elimination">
    Toggle **False Positive Elimination** to enabled
  </Step>

  <Step title="Choose Filtering Level">
    Select aggressiveness:

    * **Conservative**: Only filter obvious false positives
    * **Balanced**: Recommended default setting
    * **Aggressive**: More aggressive filtering
  </Step>

  <Step title="Save and Rescan">
    Save settings and trigger new scan
  </Step>
</Steps>

***

## Filtering Levels

### Conservative

Filters only extremely obvious false positives. Use when you want maximum sensitivity.

### Balanced (Recommended)

Filters false positives with high confidence. Optimal for most teams.

### Aggressive

Filters any violation the AI suspects might be a false positive. Use when overwhelmed with findings.

<Tip>
  Start with **Balanced**. If still seeing too many false positives, increase to **Aggressive**. If concerned about missing issues, decrease to **Conservative**.
</Tip>

***

## What the AI Checks

### Input Validation

AI looks for type checking, regex validation, whitelists, range validation, and length limits.

### Framework Protections

AI recognizes Django ORM, React JSX escaping, Rails sanitization, Spring Security, and more.

### Dataflow Analysis

AI tracks where data comes from, what transformations are applied, and whether sanitization occurs.

### Dead Code Detection

AI identifies unreachable code and test-only code paths.

***

## AI Learning

The AI learns from your codebase:

* **Pattern recognition**: Identifies your validation patterns
* **Framework usage**: Understands how you use frameworks
* **False positive patterns**: Learns what you consider false positives
* **Continuous improvement**: Gets better with each scan

***

## Results

After AI analysis, violations are marked:

* ✅ **Reviewed by AI**: AI examined and determined it's real
* ⚠️ **Likely False Positive**: AI thinks this isn't exploitable
* 🔍 **Needs Human Review**: AI couldn't determine automatically

***

## Best Practices

* Enable false positive elimination for all repositories
* Start with Balanced filtering level
* Review AI-filtered items periodically
* Provide feedback on AI decisions
* Monitor false positive rate over time

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Managing Violations" icon="list-check" href="/findings/managing-violations">
    Complete violation workflow
  </Card>

  <Card title="False Positives" icon="filter" href="/findings/false-positives">
    Manual false positive management
  </Card>
</CardGroup>