What it means
A false positive is a detection result that says the target condition is present when it is not. The target condition matters: a rule that correctly detects an unusual login may still produce an unhelpful alert if people interpret its label as confirmed account theft. Establish what the detector is intended to identify before labeling outcomes. Distinguish a harmless but accurately detected event from a parsing error or a truly mistaken classification. These differences lead to different improvements and better conversations with the people maintaining detections.
AN ILLUSTRATIVE SCENARIO
A planned software rollout triggers malware alerts
A manufacturer rolls out an approved administration script. A rule intended to detect malicious script execution generates alerts because the command pattern resembles an attack. An analyst checks the deployment record, source, signer, target devices, and timing. The investigation supports a benign disposition for this rollout. The team considers a narrow, reviewed exception instead of disabling every alert involving the scripting tool, which attackers can also use.
Put it to work
- Define the positive condition and label reviewed cases consistently. Keep the evidence and reasoning behind a benign disposition so another analyst can challenge it.
- Look for the cause of noise: missing context, an overly broad condition, incorrect parsing, or a legitimate workflow. Give the detection owner concrete examples.
- Test any tuning against both benign activity and representative malicious cases. Time-limit exceptions where possible, and document which previously detectable behavior an exception might hide.
How to check your work
After a change, rerun the legitimate scenario and a contrasting suspicious one. Check that noise falls for the intended reason and that the meaningful detection still works. Track unresolved cases separately from labeled outcomes.
Connect the ideas
- Alert
A notification that a rule or model wants a human to look at one or more records.
- Precision
True positives divided by all positive alerts in a defined, labeled evaluation set: TP / (TP + FP).
- Recall
Detected true events divided by all true events in a defined evaluation set: TP / (TP + FN). Unknown missed events limit production estimates.
- Triage
A short, time-boxed judgment of severity, uncertainty, and next action when an alert arrives.