SOC › Module 6 › Lesson 2
FP vs TP
False positive vs true positive literacy — benign cause, tuning signal, TP indicators — classify YOUR $SOC_LAB sample alerts.
Visual · t29_fp_vs_tp
FP vs TP = named disposition vocabulary. $SOC_LAB. Original Cyberlium.
Opening
Mislabeling false positives burns analyst time — and missing true positives burns the org — learn FP vs TP on YOUR sample alerts first.
False positive (FP) vs true positive (TP) literacy names: benign authorized activity matching rule (backup job, patch scan, admin tool), tuning candidate (noisy rule needing threshold or allowlist), true positive indicators (unexpected source, off-hours, chained alerts, enrichment hits), and documented disposition codes your org might use (FP-Benign, FP-Tuning, TP-Investigate). Analyst classifies $SOC_LAB sample rows — cites observed fields vs inference — without declaring prod incidents without authorization or hiding TP to clear queue. Cyberlium teaches named dispositions on instructor synthetic alerts — NOT running brute-force or malware to prove TP, NOT mass-closing real alerts as FP without review. Lab row: three sample alert snippets with FP/TP/tuning recommendation each.
1. FP classes named
FP-Benign: expected admin or automation; FP-Tuning: rule too broad — defender hygiene row.
Document reason field — not silent queue clear.
Command guide
Try these commands — FP classes named
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Triage prioritization — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final MITRE severity mapping — https://attack.mitre.org/ Elastic case management — https://www.elastic.co/guide/en/security/current/cases-ui.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
jq 'sort_by(.severity) | reverse | .[] | {id, severity, title}' "$SOC_LAB/logs/alerts.json"
cat > "$SOC_LAB/notes/triage-worksheet-ALR-002.md" <<'EOF'
# Triage Worksheet — ALR-002 (YOUR seeded alert)
## Alert summary
- ID: ALR-002 | Severity: critical
- Title: Admin logon failures from external IP
- User: administrator | src_ip: 203.0.113.50 | host: WIN-LAB01
## Enrichment (YOUR logs)
- [ ] jq auth.jsonl for 203.0.113.50 failures
- [ ] Check if IP is known VPN/break-glass (lab: assume unknown external)
- [ ] MITRE: T1110 Brute Force
## Initial assessment
- Suspicious: external IP targeting administrator account
## FP/TP call
- [ ] FP [x] TP [ ] Needs L2
## Next steps
- Open ticket, recommend block 203.0.113.50, escalate per playbook
EOFCommand — copy this
grep -E 'ALR-002|TP|escalate' "$SOC_LAB/notes/triage-worksheet-ALR-002.md"
Primary tools to practice this lesson: jq, grep. Reference sites: Triage prioritization (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE severity mapping (https://attack.mitre.org/); Elastic case management (https://www.elastic.co/guide/en/security/current/cases-ui.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. TP indicators
Unexpected geo, rare process, credential spray pattern, chained detections — literacy anchors.
One indicator ≠ confirmed breach — separate observed from inferred.
3. Scope refuse
No unauthorized attacks to manufacture TP; no suppressing real alerts without ticket.
FP/TP literacy supports disposition — not queue gaming.
4. What you ship: FP vs TP classification table
Three sample alerts + disposition + reason + NEVER attack-for-TP line.
5. What you record before the next lesson
FP vs TP classification table path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run password spray against lab partner account to 'get a true positive.'
Right
FP vs TP table from $SOC_LAB sample alerts. Next: Enrichment.
Mission: FP vs TP classification table
1) Define FP-Benign and FP-Tuning. 2) List three TP indicator examples. 3) Classify three lab sample rows. 4) Write NEVER attack-for-TP line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “FP-Tuning — who owns rule change?”
Knowledge Check
APPLY: FP-Benign means:
Multiple choice
Knowledge Check
APPLY: True or False: Running attacks to generate TP alerts is lab.
True or False
Knowledge Check
APPLY: TP disposition should:
Multiple choice