{"id":4279,"date":"2026-08-20T12:59:18","date_gmt":"2026-08-20T09:59:18","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4279"},"modified":"2026-08-20T12:59:18","modified_gmt":"2026-08-20T09:59:18","slug":"how-to-submit-a-false-positive-or-negative-sample-file-or-url-to-withsecure","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/en\/support-articles\/how-to-submit-a-false-positive-or-negative-sample-file-or-url-to-withsecure\/","title":{"rendered":"How to submit a false positive or negative sample file or URL to WithSecure"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>Real-time scanning or DeepGuard has detected a file to be malicious. How to submit a sample file to Virus labs to find out if it is a false positive?<\/p>\n<p>A web site (URL) is blocked by WithSecure either due to its rating (malicious) or category.<\/p>\n<p>What if a possibly malicious file has not been detected, how to submit a sample file to virus labs to find out if it is a false negative?<\/p>\n<h3>Resolution:<\/h3>\n<p>If you suspect that:<\/p>\n<ul style=\"list-style-type: disc;\">\n<li style=\"list-style-type: disc;\">A clean file or URL has been falsely detected as malicious, or;<\/li>\n<li style=\"list-style-type: disc;\">A file or URL that is malicious but has not been detected by our software\n<\/li>\n<\/ul>\n<p>you can submit the file for analysis suing the Sample Validation service found in the Elements portal:<\/p>\n<ol style=\"list-style-type: none;\">\n<li style=\"list-style-type: decimal;\">Log in to the Elements portal: <a href=\"https:\/\/elements.withsecure.com\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/elements.withsecure.com<\/a><\/li>\n<li style=\"list-style-type: decimal;\">Go to the\u00a0<strong>Requests<\/strong>\u00a0page on the menu on the left<\/li>\n<li style=\"list-style-type: decimal;\">Click\u00a0<strong>Create Request<\/strong><\/li>\n<li style=\"list-style-type: decimal;\">Open the\u00a0<strong>Request type<\/strong>\u00a0drop-down menu and select\u00a0<strong>Submit sample for validation\u00a0<\/strong><\/li>\n<li style=\"list-style-type: decimal;\">Open the\u00a0<strong>Sample type<\/strong>\u00a0drop-down menu and select\u00a0<strong>File <\/strong>or<strong> URL<\/strong>\n<ol style=\"list-style-type: none;\">\n<li style=\"list-style-type: lower-alpha;\">Make sure you selected the correct sample type for the <strong>File<\/strong>:\n<ol style=\"list-style-type: none;\">\n<li style=\"list-style-type: lower-roman;\">File-Based False Positive: A clean file incorrectly detected as malware. For example, a company\u2019s internal tool flagged as a trojan.<\/li>\n<li style=\"list-style-type: lower-roman;\">Potentially Unwanted Application (PUA): Legitimate software detected as unwanted. For example, a remote admin or adware-style installer used for business purposes.<\/li>\n<li style=\"list-style-type: lower-roman;\">File-Based False Negative: A malicious file not detected by the product. For example, a ransomware executable encrypts data without being blocked.<\/li>\n<\/ol>\n<\/li>\n<li style=\"list-style-type: lower-alpha;\">Make sure you selected the correct sample type for the <strong>URL<\/strong>:\u00a0\n<ol style=\"list-style-type: none;\">\n<li style=\"list-style-type: lower-roman;\">URL-Based False Positive: A safe website is blocked by mistake. For example,\u00a0<a href=\"https:\/\/withsecure.vanillacommunities.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fpartnerportal.company.com\" rel=\"noopener noreferrer\" target=\"_blank\">https:\/\/partnerportal.company.com<\/a>\u00a0blocked as phishing.<\/li>\n<li style=\"list-style-type: lower-roman;\">URL Categorization: Request to update or correct the URL category. For example, reclassifying a corporate blog from \u201cUnknown\u201d to \u201cBusiness.\u201d<\/li>\n<li style=\"list-style-type: lower-roman;\">Unknown URL: A new or uncategorized domain requiring classification. For example, submitting\u00a0<a href=\"https:\/\/withsecure.vanillacommunities.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fnewvendor.io\" rel=\"noopener noreferrer\" target=\"_blank\">https:\/\/newvendor.io<\/a>\u00a0for review.<\/li>\n<li style=\"list-style-type: lower-roman;\">URL-Based False Negative: A harmful website is not blocked by the product. For example,\u00a0<a href=\"https:\/\/withsecure.vanillacommunities.com\/home\/leaving?allowTrusted=1&amp;target=http%3A%2F%2Fmalicious-site.ru\" rel=\"noopener noreferrer\" target=\"_blank\">http:\/\/malicious-site.ru<\/a>\u00a0remains accessible and serves malware.<\/li>\n<\/ol>\n<\/li>\n<li style=\"list-style-type: lower-alpha;\">All types of sample types and their definitions can be found here: #business\/elements-welcome\/latest\/en\/creating_and_viewing_sample_validation_request_in_the_request_views-latest-en.<\/li>\n<\/ol>\n<\/li>\n<li style=\"list-style-type: decimal;\">Drag and drop the file or click\u00a0<strong>Browse<\/strong> to upload the file (if <strong>File <\/strong>submission)<\/li>\n<li style=\"list-style-type: decimal;\">Open the\u00a0<strong>Request reason<\/strong> drop-down menu and select the appropriate <strong>reason<\/strong><\/li>\n<li style=\"list-style-type: decimal;\">Open the Product name drop down menu and select the product<\/li>\n<li style=\"list-style-type: decimal;\">Add a short title for the request in the\u00a0<strong>Title<\/strong>\u00a0field.<\/li>\n<li style=\"list-style-type: decimal;\">Write down a description of the file or summary of concern<\/li>\n<li style=\"list-style-type: decimal;\">Click\u00a0<strong>Create Request<\/strong><\/li>\n<\/ol>\n<p>The sample submission is analyzed by our analysts and the databases will be updated if necessary.<\/p>\n<p>You can read more about the Sample Validation service from the user guide:\u00a0<span><a href=\"https:\/\/community.withsecure.com\/en\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fwww.withsecure.com%2Fuserguides%2Fproduct.html%23business%2Felements-welcome%2Flatest%2Fen%2Fconcept_samplevalidation-latest-en\" target=\"_blank\" rel=\"noopener noreferrer\">WithSecure User Guides<\/a><\/span>\u00a0<\/p>\n<p>Note:\u00a0If the file is larger than the upload limit, upload it via the\u00a0<a href=\"https:\/\/withsecure.sendsafely.eu\/dropzone\/customerprotection\" target=\"_blank\" rel=\"noopener noreferrer\">Dropzone<\/a><\/p>\n<ul>\n<li>Always use the password infected \u2014 this ensures safe handling by security analysts<\/li>\n<li>Never email the file directly.<\/li>\n<li>Always upload it through\u00a0<span id=\"b_888EA4D1F18C4BAE871A5056CBF53B34\">Elements Security Center<\/span>\u00a0or the\u00a0<span id=\"b_336A01B93AA94D66AF040A3021C4E469\">Dropzone in case of sample being larger then 100MB<\/span><\/li>\n<li>Include as much context as possible (where the file came from, what it does, and why you\u2019re submitting it).<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Report a false positive or negative detection<\/p>\n","protected":false},"template":"","support_article_product":[104],"class_list":["post-4279","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000005099","source_version":3,"source_system":"salesforce","source_date_updated":"2026-08-20 09:59:18","import_hash":"3d9481613a524a36539f5dd909a1ffe9dbf4b966","vanilla_article_id":29360,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/29360-how-to-submit-a-false-positive-or-negative-sample-file-or-url-to-withsecure","vanilla_kb_id":30,"vanilla_category_id":106,"machine_translated":false,"reactions_helpful_yes":1,"reactions_helpful_no":1},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article\/4279","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=4279"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article_product?post=4279"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}