When tuning security alerts, what is the best approach?

The correct answer is A. Tune to avoid False positives and False Negatives. Security alert tuning must balance two opposing error types. A false positive (FP) is a benign event incorrectly flagged as malicious; too many FPs cause alert fatigue and cause analysts to start ignoring alerts. A false negative (FN) is a real attack that goes undetected; too…

Evading IDS, Firewalls, and Honeypots

Question

Options

ATune to avoid False positives and False Negatives
BRise False positives Rise False Negatives
CDecrease the false positives
DDecrease False negatives

How the community answered

(36 responses)

A
78% (28)
B
14% (5)
C
6% (2)
D
3% (1)

Explanation

Security alert tuning must balance two opposing error types. A false positive (FP) is a benign event incorrectly flagged as malicious; too many FPs cause alert fatigue and cause analysts to start ignoring alerts. A false negative (FN) is a real attack that goes undetected; too many FNs leave the organization exposed. Lowering only FPs (C) typically raises the detection threshold, which increases FNs-real attacks slip through. Lowering only FNs (D) typically lowers the threshold, flooding analysts with FPs. The ideal goal (A) is to tune rules so both error types are minimized simultaneously, achieving a system that is sensitive enough to catch real threats while specific enough not to overwhelm responders with noise. Choice B (raising both) is the worst possible outcome.

Topics

#IDS tuning#false positives#false negatives#alert management

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice