Which two of the following best describe the characteristics of false positive alerts in a security operations context? (Choose two)

A false positive, in the context of security monitoring, is an alert that incorrectly indicates the presence of a threat. This occurs when a security system, such as an Intrusion Detection System (IDS) or a Security Information and Event Management (SIEM) tool, misinterprets a harmless or legitimate event as malicious. Both "legitimate user actions" (A) and "benign activity" (B) accurately describe the nature of the event that triggers the false alarm. These alerts require investigation to confirm their benign nature, and frequent false positives can lead to alert fatigue among security analysts.

C. This describes a true positive, where a malicious event is correctly identified and flagged by the security system.

D. This is incorrect because an alert requires investigation to be classified as a false positive; it cannot be assumed that no action is needed beforehand.

E. This describes a false negative, which is the failure of a security system to detect and alert on actual malicious activity.

1. National Institute of Standards and Technology (NIST), Special Publication 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS), February 2007.

Section 3.2.1, Accuracy: "False positives are alerts that are not indicative of actual attacks. They are also known as false alarms. A high false positive rate causes a great deal of wasted time and effort." This supports the idea that benign activity is incorrectly flagged.

2. Garcia-Teodoro, P., Diaz-Verdejo, J., Maciá-Fernández, G., & Vázquez, E. (2009). Anomaly-based network intrusion detection: Techniques, systems and challenges. Computers & Security, 28(1-2), 18-28.

Section 2.1, Detection models: "False Positive (FP): a legitimate action is considered as anomalous and an alarm is generated." This directly supports option A, where legitimate actions are flagged. (https://doi.org/10.1016/j.cose.2008.08.003)

3. University of California, Berkeley, CS 161: Computer Security, Fall 2020 Lecture Slides.

Lecture 15: Network Intrusion Detection, Slide 19: Defines a False Positive as "Alarm, but no attack." This aligns with an alert being triggered by a benign (non-attack) activity, as stated in option B.