False positive
An alert that fires on activity that is not actually malicious; its counterpart, a false negative, is malicious activity that raised no alert.
Detection outcomes form a confusion matrix: true positive (malicious, alerted), false positive (benign, alerted), false negative (malicious, missed), true negative. Many SOCs also track benign positives: the rule worked as written, but the activity was authorised (an admin running PsExec).
Tuning is a trade-off. Every exclusion reduces noise and also creates a blind spot attackers can hide in (excluding a path an attacker can write to is the classic mistake). Good tuning narrows on stable, attacker-hard-to-control attributes and records why each exclusion exists and when to revisit it.
Precision (TP / (TP + FP)) is worth measuring per rule; a rule that has never produced a true positive in a year needs either a test proving it still works or retirement.
Learn it properly
Compared
Also used in
- AI in the security SDLCSecEng · AI, vibe coding & logic structuringFree
- Design a bot detection systemHLD · Design problems: fraud & abuseFree
- Design an account takeover detection systemHLD · Design problems: fraud & abuseFree
- Design an email security gatewayHLD · Design problems: communication securityFree
- Writing Sigma rulesAnalyst · Query & detection craftFree
- IOCs, TTPs and the pyramid of painAnalyst · Threat intelligence for analystsFree
- Writing intelligence reportsAnalyst · Threat intelligence for analystsFree
- Secrets management and rotationSecEng · Identity & Access EngineeringPro