A company's SIEM is continuously reporting false positives and false negatives. The security operations team has implemented configuration changes to troubleshoot possible reporting errors. Which of…

The correct answer is B. Trends D. Alert failures. The best sources of information to support the analysis process for troubleshooting false positives and false negatives in a SIEM are: Trends – Analyzing trends helps identify patterns in alerts, such as recurring false positives or missed detections (false negatives), allowing…

Submitted by valeria.br· Mar 6, 2026Security Operations

Question

A company's SIEM is continuously reporting false positives and false negatives. The security operations team has implemented configuration changes to troubleshoot possible reporting errors. Which of the following sources of information best supports the required analysis process? (Choose two.)

Options

AThird-party reports and logs
BTrends
CDashboards
DAlert failures
ENetwork traffic summaries
FManual review processes

How the community answered

(47 responses)

A
9% (4)
B
83% (39)
C
2% (1)
E
4% (2)
F
2% (1)

Explanation

The best sources of information to support the analysis process for troubleshooting false positives and false negatives in a SIEM are: Trends – Analyzing trends helps identify patterns in alerts, such as recurring false positives or missed detections (false negatives), allowing the team to adjust rules or thresholds accordingly. Alert failures – Reviewing alert failures (e.g., missed detections or incorrect alerts) provides direct insight into why the SIEM is generating false positives or negatives, helping refine detection logic.

Community Discussion

No community discussion yet for this question.

Full CAS-005 Practice