True Positive vs. False Positive: Alert Triage for Beginners

Here's the dirty secret of SOC work: most of the alerts you investigate turn out to be nothing.

Not "nothing" as in you wasted your time—"nothing" as in the alert fired, you checked it, and it wasn't actually an attack. That's the job. And knowing how to tell a real threat from a false alarm—fast—is the single most important skill an entry-level analyst has.

So let's nail down the vocabulary everyone in a SOC uses all day: true positive, false positive, and the two cousins nobody explains well.

The Four Outcomes, Explained Like a Human

Every time an alert fires, there are only four possible realities. Security borrows this straight from statistics, but forget the math—here's what each one actually means.

True Positive (TP) — The alert fired, and there was a real threat. The detection did its job. This is the one you escalate.

False Positive (FP) — The alert fired, but there was no real threat. A false alarm. Annoying, but you close it out (and ideally, tune it so it stops crying wolf).

True Negative (TN) — No alert fired, and there was no threat. This is the quiet, boring, correct default. You never see these, and that's fine.

False Negative (FN) — No alert fired, but there was a threat. This is the scary one. The attack slipped through and nobody knew. False negatives are what keep SOC managers up at night.

Get comfortable with these four. You'll hear them in every standup, every ticket, every interview.

Why Do Analysts Obsess Over False Positives?

Because they'll drown you if you let them.

A typical SOC generates way more alerts than any human could investigate. When most of those are false positives, analysts start tuning out—and that's called alert fatigue. It's a real, dangerous thing.

Here's the trap: if you see 200 false positives in a row, alert number 201 (the real one) starts to look like just more noise. That's exactly how a false negative sneaks past a tired analyst.

So false positives aren't just annoying. Left unchecked, they're how real attacks get missed. That's a big reason so much SOC training misses the mark—it teaches tools, not the judgment to separate signal from noise.

The Sneaky One: Benign True Positives

Here's a wrinkle that trips up new analysts.

Sometimes an alert is technically accurate but still not malicious. The detection correctly spotted the behavior it was built to catch—but a human did it for a legitimate reason.

Example: an alert fires for "PowerShell downloading a file." That genuinely happened. But it was your IT admin running a legit script, not an attacker. The detection worked perfectly; the activity just wasn't a threat.

That's a benign true positive. It's not a false positive (the detection was right) and it's not something you escalate (it's not malicious). You document it, maybe tune the rule, and move on. Knowing the difference makes you look sharp fast.

How Do You Actually Triage an Alert?

When an alert lands, you're basically running a quick investigation to decide: real or not real? Here's a simple loop you can use from day one.

1. Read the alert. What fired, on what host, for which user, and why? Understand what the detection is actually claiming before you go digging.

2. Establish normal. Is this behavior weird for this user or system? An admin running scripts at noon is normal. A receptionist's laptop spawning PowerShell at 3 a.m. is not.

3. Pull the context. Check the logs around the event—parent processes, network connections, recent logins. This is where reading logs like an analyst pays off.

4. Make a call. True positive? Escalate with your evidence. False positive or benign? Document why, close it, and flag the rule for tuning if it keeps misfiring.

5. Write it down. Your notes are the next analyst's shortcut—and your own proof of work.

Do this loop a few hundred times and it becomes instinct. That's basically what your first SOC job trains into you.

Isn't the Goal Just "No False Positives"?

Nope—and this surprises people.

You could crush false positives to zero by making your detections super strict. But then you'd start missing real attacks (hello, false negatives). Tune too loose and you drown in noise. Tune too tight and threats slip through.

The whole art of detection engineering is finding that balance—catching real threats without burying analysts in junk. As an analyst, your triage decisions are the feedback loop that makes those detections better. Every "this was a false positive because…" note you write is fuel for a smarter rule.

TL;DR – Learn These Four Words Cold

True positive: real alert, real threat—escalate it. False positive: alert fired, no threat—close it. True negative: quiet and correct. False negative: the threat you missed—the scariest one. Most of your day is separating true positives from false positives without getting numb to the noise. Master that judgment and you're already ahead of most beginners.

---

FAQs

What's the difference between a false positive and a false negative?

A false positive is an alert that fired when there was no real threat (a false alarm). A false negative is a real threat that didn't trigger an alert (a miss). False positives waste time; false negatives let attacks through. Both matter, but false negatives are more dangerous.

What is a benign true positive?

It's an alert that correctly detected the behavior it was designed to catch, but the behavior turned out to be legitimate—like an admin running an approved script. The detection was accurate, so it's not a false positive, but there's no threat, so you don't escalate. You document it and maybe tune the rule.

How do I get better at telling true positives from false positives?

Learn what "normal" looks like for the systems you watch, get comfortable reading logs for context, and practice on realistic scenarios. Repetition is everything—the more real alerts you triage, the faster your judgment gets.

---

Sources & References:

- NIST SP 800-92: Guide to Computer Security Log Management

- MITRE ATT&CK Framework

- SANS: Alert Triage and Analysis Resources

---

Final thought: Anyone can close alerts. The analysts who get promoted are the ones who can look at a messy pile of events and calmly say "that one's real"—and prove it. That judgment isn't a talent you're born with. It's a muscle you build one alert at a time.

How EpicDetect Can Help

Want to practice this for real—not multiple choice, an actual investigation? Adventures Season Zero drops you into a story-driven SOC case where you'll triage alerts and separate the real threats from the noise yourself. It's completely free.

Want structured lessons alongside it? Head to the EpicDetect Atlas for SIEM fundamentals, log analysis, and MITRE ATT&CK-tagged challenges.

New here? Sign up and start for free. No credit card required.