If a user receives a workbench detection alert in Trend Vision One and needs to determine if it is a false positive or not, they can take the following steps:

1. Access the particular location ID associated with the alert.
2. Right-click on the IP address in question.
3. Under Response, choose Add to Block List.
4. Confirm that the suspicious object is added by navigating to Threat Intelligence > Suspicious Object Management.