Random false positive match on keyword for Endpoint incidents