False Positive
What is False Positive?
An alert or detection that incorrectly indicates malicious activity when the activity is actually legitimate. High false positive rates reduce the effectiveness of security monitoring by causing alert fatigue.
Frameworks that govern false positive
What the standards actually require on false positive
Requirements naming false positive across 6 standards, quoted from the control text.
Establish a process to create high quality alerts and measure their quality, so analysts prioritise real incidents rather than spending time on false positives.
ASBv3-IR-3 · Detection and analysis - create incidents based on high-quality alerts →Vulnerability analysis must combine automated scanning and manual validation to identify weaknesses, eliminate false positives, and confirm exploitability paths.
PTES-VA-1 · Vulnerability Analysis Approach →Continuous security monitoring + 24x7 SOC operations are expected per FSA Cybersecurity Guidelines particularly for Tier 2/3 institutions. (1) SOC Operating Models: (a) Internal SOC - dedicated team + tooling;
JP-FSA-CYB-Security-Monitoring-SOC-Operations-SIEM-EDR-MDR-XDR-24x7-Detection-Alert-Triage · Japan FSA Cybersecurity Security Monitoring + SOC 24x7 Operations + SIEM + EDR + MDR + XDR + Detection + Alert Triage + Threat Hunting + Incident Response Integration + Threat Intelligence Integration + UEBA →Implement malicious code protection at system entry and exit points; update protection mechanisms; configure to perform periodic scans and real-time scans of files; address receipt of false positives.
03.14.02 · Malicious Code Protection →The risk associated with automated agents (NPEs) configuring and enforcing policy, including false positives and false negatives in automated decisions.
SP800-207-THR-NPE · Threat: Use of Non-Person Entities (NPE) in ZTA Administration →Requires malicious code protection mechanisms to be implemented at system entry and exit points, updated automatically as new releases appear under configuration management, configured to scan periodically at a defined frequency and in real time as files arriv...
NIST800-SI-3 · Malicious code protection →Questions people ask about false positive
What is False Positive?
Why is False Positive important for compliance?
Which compliance frameworks address False Positive?
Where can I learn more about False Positive?
See how False Positive applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.