A correlation search treats every municipal syslog line as a failed logon because a technical add-on maps the wrong field. Which disposition fits?
Select an answer to reveal the explanation.
Short Explanation
If every syslog burp looks like a failed logon, the analytic is miswired—not the whole city under brute force. Call it False Positive - Incorrect Analytic Logic. A notable firing is not automatic proof of an attack.
Full Explanation
False Positive - Incorrect Analytic Logic applies when the correlation search or its field mapping is wrong, including a technical add-on mapping that makes every syslog line look like a failed logon. The notable is not a True Positive merely because it fired. Benign Positive requires the detection to be correct about expected activity. Mapping defects can and should be given a final disposition so engineering can fix the logic.