David is a SOC analyst in Karen Tech. One day an attack is initiated by the intruders but David was not able to find any suspicious events. This type of incident is categorized into ?

This scenario describes a False Negative. In the context of security monitoring and intrusion detection, a false negative occurs when a malicious event or attack actually happens, but the security system fails to detect it and generate an alert. David, the SOC analyst, was unable to find any suspicious events despite an attack being initiated, meaning the monitoring tools missed the intrusion. This is the most dangerous type of detection error, as it creates a false sense of security while an attacker may be active on the network.

A. True Positive Incidents: This is when a real attack occurs and the system correctly generates an alert, which is the opposite of what happened.
B. False positive Incidents: This is when the system generates an alert for a malicious event, but the event was actually benign.
C. True Negative Incidents: This describes the normal, desired state where no attack occurs and no alert is generated by the system.

1. Scarfone, K., & Mell, P. (2007). Guide to Intrusion Detection and Prevention Systems (IDPS). NIST Special Publication 800-94. National Institute of Standards and Technology. Section 2.2.3, "Alerts," defines false negatives as "A failure of an IDPS to detect an actual malicious activity." (p. 2-4).

2. Pfleeger, C. P., Pfleeger, S. L., & Margulies, J. (2015). Security in Computing (5th ed.). Prentice Hall. Chapter 7, "Intrusion Detection," discusses the performance of intrusion detection systems, defining a false negative (or Type II error) as the failure to report a real attack.