At a retailer, a security alert fires and the analyst confirms that a real beacon is running on the checkout register. How should this investigated result be classified?
Select an answer to reveal the explanation.
Short Explanation
The alarm and the intruder in the aisle are a matched pair. You have both an alert and a confirmed beacon on the register, so this result is a true positive. Do not relabel a verified attack as noise, as a silent night, or as allowed work.
Full Explanation
A true positive needs both an alert and a real attack, and both are present here. A true positive: an alert that matches a beacon confirmed on the register, is the classification after the analyst verifies the callback. A false positive: an alert on register activity that investigation shows is not an attack, would apply if the review had found no beacon and no intrusion. A true negative: a quiet period with no alert and no intrusion on the register, describes silence on a clean host, and this case began with an alert. Benign activity: real register traffic that policy allows and that is not an attack, would fit an authorized action, and a confirmed beacon on the register is not allowed work. Confirming the beacon is what moves an unreviewed alert into the true-positive class. Exam caveat: the label follows the investigation, not the color or severity string on the original alert. Operational check: keep the alert identifier with the evidence that showed the beacon, such as the calling process or the confirmed callback, before the case is closed as a true positive.