An MSSP customer wants every alert called a true positive. On a customer host, an authorized backup trips a rule that labels the transfer as data theft. What is the right label for that alert?
Select an answer to reveal the explanation.
Short Explanation
A smoke alarm during a planned kitchen test is loud and still wrong about a fire. The theft rule fired on an authorized backup, so you label that alert a false positive. A true positive needs a real attack, a false negative is a miss, and a true negative is silence on a clean host.
Full Explanation
The rule said data theft, and the activity was an authorized backup, so an alert fired on something that is not an attack. A false positive: a theft alert fired on an authorized backup that is not an attack, is the label that matches those two facts. A true positive: an alert that correctly treats the authorized backup as a data-theft attack, would require a real attack, and a scheduled backup is not one. A false negative: a real attack on the customer host during a window when this rule stayed silent, would be a miss, and this rule did fire. A true negative: a period with no alert and no suspicious activity on the customer host, would be silence on a clean window, and an alert was produced. The backup was authorized work, and the rule's theft label does not turn that work into an intrusion. Exam caveat: a customer request that every alert be a true positive does not change the definition; a true positive still needs both the alert and an attack. Operational check: match the backup account, the schedule, and the destination to the alert before the rule is tuned or the case is closed as theft.