What is False Positive?

False positives are one of the central operational challenges in any SOC. Detection rules and ML models are probabilistic. They fire on patterns associated with malicious behavior, but those patterns sometimes appear in legitimate activity. An IDS rule detecting port scanning fires on a legitimate network discovery tool. A UEBA alert for off-hours access fires on an employee working late. A malware hash detection fires on a security research tool.

The false positive rate directly impacts SOC capacity. If 95% of alerts are false positives, analysts spend most of their time on non-threats, and the 5% that are real attacks get delayed or missed. Alert fatigue, the psychological state where analysts become desensitized and start closing alerts without proper investigation, is a serious consequence of chronically high false positive rates.

Reducing false positives requires continuous tuning: analyzing patterns, identifying legitimate triggers, adding suppression logic for known-good behavior, and refining detection logic. Good SOC operations teams track false positive rate as a KPI and hold detection engineers accountable for fidelity metrics.