Clear Threate View

[DanJordan]

Hi, I am in process of clearing up all the PUMs I deem as false positives. We currently have 18,000 alerts in threat view which I believe I have added most of these to the ignore list. I would like to know how to clear all these in bulk as the Page "All" option does not show me all threats to then highlight and remove. Any advice? Sure it's a simple option somewhere.

[djacobson]

Hi @DanJordan, from 'Threat View', click the 'Filter' button. In the 'Threat Name' field, type in "pum" or "policies, as I take it the false positive PUM's you are looking for are GPO enforcement's. Using a common word between all these PUM's will make the next step all that much easier. Once you click 'OK', the results should be just your particular FP's. Hit Ctrl + A or Ctrl + click the ones you want to remove. Once highlighted, right click and select 'Remove Log Entry'.

If these PUM's are your GPO keys, the reason why is MBAM agent 1.80.x is indiscriminate when it comes to any registry modifications. It will hit on your legit GPO enforcement's. Add your GPO registry key(s) to the Policy → Ignore list, replacing the account SID‘s with the * wildcard. Note that only console and client communicator together at 1.6.1.2897 and above with Anti-Malware 1.80.1.1011 and above, supports this wildcard in the middle of a string, and only for registry keys.

To aid in your ignore efforts, here’s a list I made of all the GPO changes I’ve seen get tagged as PUM: 
hku\*\software\microsoft\windows\currentversion\policies\explorer|NoStartMenuMorePrograms
hku\*\software\microsoft\windows\currentversion\policies\explorer|NoSetFolders
hku\*\software\microsoft\windows\currentversion\policies\explorer|NoFind
hku\*\software\microsoft\windows\currentversion\policies\explorer|NoSMHelp
hku\*\software\microsoft\windows\currentversion\policies\explorer|NoRun
hku\*\software\microsoft\windows\currentversion\policies\explorer|NoViewContextMenu
hku\*\software\microsoft\windows\currentversion\policies\explorer|NoToolbarCustomize
hku\*\software\microsoft\windows\currentversion\policies\explorer|NoPropertiesMyComputer
hku\*\software\microsoft\windows\currentversion\policies\explorer|NoDrives
hku\*\software\microsoft\windows\currentversion\policies\explorer|ForceActiveDesktopOn
hku\*\software\microsoft\windows\currentversion\policies\system|DisableRegistryTools
hku\*\software\microsoft\windows\currentversion\policies\system|NoDispCPL
hku\*\software\microsoft\windows\currentversion\policies\system|NoDispBackgroundPage
hku\*\software\microsoft\windows\currentversion\policies\system|NoDispAppearancePage
hku\*\software\microsoft\windows\currentversion\policies\system|NoDispScrSavPage
hku\*\software\policies\microsoft\internet explorer\control panel|ConnectionsTab
hku\*\software\policies\microsoft\internet explorer\control panel|HomePage
hku\*\software\policies\microsoft\windows\system|DisableCMD