Hack the Route Start free Open app Detection and response
True and false positives
An alert's worth is how often it is a real attack versus noise, which decides whether anyone acts on it.
A true positive is an alert that really is an attack; a false positive is a harmless event that tripped the alert anyway; a false negative is an attack that raised no alert at all. Detectors drowning in false positives get ignored, so the ones defenders trust are those that are almost always right — a honeypot touch, a beacon to a known-bad address. Reading a capture after the fact is the opposite trade: slow, but you confirm exactly what happened.