False positive

How it is used

Very common in SOC and scanning work: analysts mark alerts as false positives and tune rules to reduce them. The opposite problem, a real attack that goes unnoticed, is a false negative and is usually more dangerous.

Example sentences

1. It was a false positive: the backup job looked like data exfiltration.

2. This scanner reports a lot of false positives on our Linux servers.

Common collocations

• mark as a false positive
• reduce false positives
• false positive rate
• false negative

Related terms

• alertA notification from a security tool saying that something suspicious or important has happened and may need a person to look at it.
• SIEMSecurity information and event management: a platform that collects logs from many systems, correlates them and raises alerts about possible attacks.
• intrusion detection systemA tool that monitors network traffic or system activity for signs of attacks or policy violations and raises an alert when it finds them.
• vulnerability scanAn automated check of systems, networks or applications that looks for known weaknesses, missing patches and insecure settings and lists them in a report.

This word in other fields

The same English word can have a different meaning in another field:

• false positive · Software Engineering

More terms: Security Operations and Monitoring

• log
• SOC
• blue team
• endpoint
• EDR
• threat intelligence
• threat hunting