When no anomaly is present in an Intrusion Detection, but an alarm is generated, the response is known as __________.

A true negative is the correct outcome where no anomaly is present and no alarm is generated, meaning the system correctly identifies normal traffic.

A true positive is also a correct outcome where an anomaly is present and the IDS correctly generates an alarm.

A false negative is the most dangerous IDS failure - an anomaly or attack is present but the IDS fails to generate any alarm, allowing the threat to go undetected.

A false positive occurs when the IDS generates an alert in the absence of any real threat or anomaly - the alarm is 'false' because the threat does not exist, yet the system 'positively' flagged it. This is also called a false alarm and is a key metric for evaluating IDS accuracy because excessive false positives degrade analyst trust and efficiency.