Which class of IDS events occur when the IDS fails to alert on malicious data?

A true negative occurs when the IDS correctly does not alert on benign, non-malicious traffic - this is the desired normal behavior.

A true positive occurs when the IDS correctly identifies and alerts on actual malicious traffic - this is the desired detection outcome.

A false positive occurs when the IDS incorrectly generates an alert on legitimate, non-malicious traffic, causing unnecessary investigation.

A false negative is the outcome where malicious activity is present but the IDS does not detect or alert on it, allowing the attack to go unnoticed. This is one of the most dangerous IDS failure modes because the security team remains unaware of a real threat. False negatives often result from outdated signatures, evasion techniques, or misconfigured detection thresholds.