Which of the following is the process of categorizing attack alerts produced from an IDS in order to distinguish false positives from actual attacks?

Alarm filtering involves applying rules, thresholds, or correlation logic to the raw alert stream produced by an IDS in order to categorize each alert as a confirmed attack, a false positive, or a low-priority event. By suppressing or deprioritizing benign alerts, security teams can focus their investigation on alerts that represent actual threats, improving both efficiency and detection accuracy.

A confidence value is a numeric score assigned to an individual alert that indicates the likelihood it represents a real attack; it is a metric used within alarm filtering, not the overall categorization process itself.

A reactive system is an IDS component or capability that automatically responds to detected attacks (for example, by resetting connections or updating firewall rules), which is a response function rather than an alert classification process.

A site policy defines the rules and thresholds that govern what the IDS monitors and flags, but it is the configuration framework rather than the process of categorizing the resulting alerts.