What is a false positive?¶

A false positive occurs when a security system identifies activity as suspicious or malicious when the activity is not actually malicious in the relevant context.

Avoid the dangerous assumption¶

The dangerous assumption is that a false positive means the alert was defective or useless.

It may not.

The alert may have correctly detected the activity it was designed to find. The problem may be that the same technical behaviour can occur for legitimate reasons.

Examples include an administrator using a command also used by attackers, a vulnerability scanner testing systems, a backup creating an unusually large transfer, a user signing in from a new location, legitimate remote-support software creating an interactive session or a test file triggering antivirus detection.

A false positive should be supported by an explanation, not merely dismissed because no harm was immediately found.

Ask what evidence established the legitimate explanation. Was there an approved change record? Did an identified administrator confirm the action? Was the activity part of a scheduled test? Did logs show that the suspicious action was blocked or incomplete?

Also check whether the alert concealed a different issue. Legitimate software may have been used by an attacker. A real administrator account may have been compromised. An approved tool may have been run at an unapproved time.

Organisations may use related terms such as “benign positive”. This normally means the activity occurred and the detection was technically correct, but the behaviour was authorised or harmless in context.

Retain the alert and the reasoning used to close it. That closure decision may later become relevant if similar activity appears elsewhere.

A false-positive assessment is a conclusion based on available information. It should remain open to review if new evidence emerges.

Operational takeaway¶

Do not dismiss an alert as a false positive without recording the evidence that explains the activity and testing whether legitimate tools or accounts were misused.