A detection rule at a bank alerts on a vulnerability scanner the bank scheduled, and that scanning is not an intrusion. How should the alert be classified?
Select an answer to reveal the explanation.
Short Explanation
The bell during a scheduled drill is loud, and the drill is still a drill. Your bank scanner was authorized and is not an intrusion, so an alert that calls it an attack is a false positive. A silent sensor, a real break-in, or a quiet clean network would be classified differently.
Full Explanation
A false positive is an alert that claims an attack when the activity is not an attack. The bank scheduled this vulnerability scanner, the rule fired, and the scanning is not an intrusion. The detector was wrong about the nature of the activity. A false positive: the detector called the bank's scheduled vulnerability scan an attack, and the scan is not an intrusion. Silence plus a real attack is the opposite miss. A false negative: the scheduled vulnerability scan was a real intrusion, yet the sensor stayed completely silent requires both an intrusion and no alert. Here the sensor did alert, and the scan is not an intrusion. A correct alarm requires a real attack. A true positive: the alert fired, and the bank's own scheduled scanner activity was itself a genuine intrusion gets the alert half right and the intrusion half wrong. Quiet plus nothing happening is a different cell. A true negative: the sensor stayed quiet and the scheduled vulnerability scanner did not run on the bank network fails both ways: the sensor was not quiet, and the scanner did run. Exam caveat: false positive requires the detector to have called the activity an attack. The same authorized scan, had it produced no alert, would not be filed as a false positive. Operational check: document the scanner's approved window and the rule that fired, then tune or exception the rule so the scheduled scan stops consuming the queue.