False Positive vs. True Positive

The distinction between a false positive and a true positive hinges on a single question:

Did the tool or rule do what it was designed to do?

True Positive

A true positive occurs when a rule fires correctly, in accordance with its defined logic and conditions. The detection behaved exactly as intended based on how it was written and deployed.

False Positive

A false positive occurs when a rule fires incorrectly, triggering an alert or event when it should not have, given its intended logic and scope.

An Important Clarification

This classification evaluates rule performance, not downstream business or security impact.

Whether the triggered event represents benign activity, suspicious behavior, or confirmed malicious action is a separate analytical step that occurs after the disposition of the rule itself.

Conflating rule accuracy with impact assessment often leads to misunderstanding detection quality and can result in unnecessary tuning or missed gaps.

---