IBM Cloud Docs
Runtime policy tuning

Runtime policy tuning

The runtime policy tuning feature helps reduce false positive inicators in the IBM Cloud® Security and Compliance Center Workload Protection events feed. Built on the Falco Rules Tuner, it automatically adds exceptions to rules, and removes noisy sets of policy events while lower-volume events are retained for later analysis.

IBM Cloud Security and Compliance Center Workload Protection implements Sysdig Secure functionality. Information that is provided by the Sysdig Secure documentation applies to Workload Protection as well.

For more information, see Runtime threat detection policy tuning