What is a false positive?¶

A false positive is an alert or detection that identifies activity as suspicious or malicious when the underlying activity is actually benign.

It is a classification outcome, not evidence that the alert was pointless.

Avoid the dangerous assumption¶

The dangerous assumption is that a false positive means the system malfunctioned or the underlying events can be ignored.

That is not necessarily true.

The rule may have worked exactly as configured. Legitimate activity may simply have matched the same technical pattern as an attack. An administrator running a script, a vulnerability scanner or a user travelling abroad can all trigger valid rules.

The underlying events remain real even when the malicious interpretation is wrong. They may still help explain what happened and why the rule triggered.

Investigators should establish who classified the alert as a false positive and on what evidence. An automated closure, quick analyst decision and full technical review do not carry the same weight.

Preserve the source events, rule logic, analyst notes and closure reason. Check whether the classification was later changed or whether similar alerts occurred elsewhere.

Do not use “false positive” to mean that no event occurred. It means the alert’s suspicious interpretation was not supported after review.

Equally, a previous false-positive classification does not guarantee that every future alert of the same type is benign. Circumstances and source evidence must be examined each time.

Operational takeaway¶

A false positive is a genuine event incorrectly interpreted as suspicious by a detection process, so investigators should preserve the underlying evidence and understand the basis of the benign classification.