About EDR/XDR like SentinelOne in general

Hello,

I'm junior in this area but I got a question which can sound dumb but...

How do you guys allow/whitelist process that are blocked by SentinelOne for example called false positive ?

I mean what is the good process to be sure that what you gonna whitelist is truly legit and not
malicious ?

I'm scared to allow something malicious, especially if the EDR did a fine job by blocking it at first.

What I do for now is …

cybersecurity edr general sentinelone xdr