1. A method, comprising: analyzing, by a device in a network, data regarding a detected anomaly at a distributed learning agent (DLA) of a plurality of DLAs in the network; determining, by the device, whether the detected anomaly is a false positive; generating, by the device, a white label for the detected anomaly based on a determination that the detected anomaly is a false positive; selecting, by the device, a subset of the plurality of DLAs to receive the white label based on each DLA of the subset observing traffic in the network from similar vantage points, wherein the subset of DLAs is selected based on topology information regarding the network and potential network overhead attributable to the one or more distributed learning agents sending alerts in response to detecting the anomaly; and causing, by the device, one or more alerts regarding the detected anomaly to be suppressed at the subset of DLAs using the generated white label for the anomaly.