4.2Judging alert impact (true/false positives and negatives)

Detection is evaluated as the product of two binaries: "fired vs. did not fire" and "actually malicious vs. legitimate." Failing to map this 2x2 correctly means burning time on harmless alerts (leaving false positives unmanaged) or missing real breaches (overlooking false negatives). Daily SOC work is prioritizing which alerts get scarce human attention, and that judgment hinges precisely on this classification. This section ties each quadrant's meaning to which hurts operationally (a miss—an FN—is worst; noise—an FP—is exhausting), from the standpoint of triage and tuning.

4.2.1The detection 2x2

• A true positive (TP) is a correct detection: the alert fired and the activity really was malicious—the events a SOC should act on, driving prompt triage and response. A true negative (TN) is the normal state: no alert fired and nothing malicious occurred; most of daily life is this, requiring no active response.
• A false positive (FP) is a false alarm: the alert fired but the activity was harmless. It does no direct harm, but in volume it buries the real ones and causes alert fatigue, so it is the target of signature/threshold tuning and suppression. A false negative (FN) is a miss: no alert fired even though malicious activity actually occurred. Because a breach proceeds undetected, this is the most dangerous quadrant, demanding that the cause of the miss (missing signatures, visibility gaps) be closed.

4.2.2Benign triggers and operational weight

• A benign trigger is when a signature or condition technically matched but the activity was legitimate and authorized in context—e.g., an authorized scheduled vulnerability scan matching an IPS "attack-like pattern." Being harmless, it is effectively an FP, yet it is distinguished from a pure misfire in that "the signature is working correctly," and the standard remedy is to cut noise via suppression or exception entries.
• Operational weighting: an FN is the most dangerous because it is undetected—you cannot even know it exists, which is graver than "visible" problems like FPs or benign triggers. Meanwhile FP/benign bury TPs in excess noise and delay response (indirectly inducing FNs). So a SOC continuously balances sensitivity and precision, driving FNs toward zero while tuning down FP/benign.

In your SOC, the same IPS alert SID ... "SQL Injection Attempt" fires in bulk every Tuesday at midnight. Investigation shows the source is an internal authorized vulnerability scanner, and Tuesday midnight is its scheduled scan window. Here the IPS signature correctly matched a "SQL-injection-like pattern," yet the activity itself is legitimate—this is a benign trigger, distinct from a pure misfire (a signature that is simply wrong). The sound operational move is not to disable the signature (that would miss real SQLi—creating an FN) but to add a suppression/exception scoped to this source IP and time window, killing only the noise. Casually silencing the signature "because it is noisy" would plant a false negative (FN): when a real attack next comes, nothing fires. On another day, suppose the same asset produced "no alert at all," yet later forensics reveals data exfiltration to the outside. That is a false negative—malicious activity with no alert—the worst quadrant for a SOC. The cause is often a signature gap or a lack of visibility in the first place (encryption, an unmonitored path), and unlike benign tuning, you close it by adding/strengthening detection. These two cases show that even the same "few alerts" state is entirely different when it results from correctly silencing the harmless (good) versus from missing the malicious (worst)—and misclassifying one as the other leads to dangerous operations.

4.2.3Section summary

• Detection is the 2x2 of fired/not x malicious/harmless: TP = fired x malicious, FP = fired x harmless, TN = no-fire x harmless, FN = no-fire x malicious
• An FN is a miss and most dangerous (invisible); an FP causes alert fatigue. Their causes and remedies are opposite (strengthen detection vs. tune/suppress)
• A benign trigger matched a signature but was legitimate (effectively FP, signature works); do not disable the signature—remove only noise via suppression scoped to source/time