1. A method, comprising: analyzing, by a device in a network, data regarding a detected anomaly in the network; determining, by the device, whether the detected anomaly is a false positive; generating, by the device, a white label for the detected anomaly based on a determination that the detected anomaly is a false positive; and causing, by the device, one or more alerts regarding the detected anomaly to be suppressed using the generated white label for the anomaly.