4.2Judging alert impact (true/false positives and negatives)

Detection is evaluated as the product of two binaries: "fired vs. did not fire" and "actually malicious vs. legitimate." Failing to map this 2x2 correctly means burning time on harmless alerts (leaving false positives unmanaged) or missing real breaches (overlooking false negatives). Daily SOC work is prioritizing which alerts get scarce human attention, and that judgment hinges precisely on this classification. This section ties each quadrant's meaning to which hurts operationally (a miss—an FN—is worst; noise—an FP—is exhausting), from the standpoint of triage and tuning.

4.2.1The detection 2x2

• A true positive (TP) is a correct detection: the alert fired and the activity really was malicious—the events a SOC should act on, driving prompt triage and response. A true negative (TN) is the normal state: no alert fired and nothing malicious occurred; most of daily life is this, requiring no active response.
• A false positive (FP) is a false alarm: the alert fired but the activity was harmless. It does no direct harm, but in volume it buries the real ones and causes alert fatigue, so it is the target of signature/threshold tuning and suppression. A false negative (FN) is a miss: no alert fired even though malicious activity actually occurred. Because a breach proceeds undetected, this is the most dangerous quadrant, demanding that the cause of the miss (missing signatures, visibility gaps) be closed.