What is True Positive?

True positives are the entire reason a detection stack exists: every correlation rule, behavioral model, and threat intelligence feed is built to surface them. But confirming that an alert is a true positive is only the first classification decision, not the end of the analysis. A true positive covers a huge range of severity, from a phishing email that was already blocked at the gateway and never reached a user, to active ransomware encryption spreading across a file server in real time, and the response each demands is completely different even though both get labeled true positive in a case management system.

Detection quality is usually measured with two competing rates. True positive rate, also called detection rate or recall, is the percentage of actual attacks the detection stack successfully catches. False negative rate is its inverse: the percentage of real attacks that generate no alert at all and go unnoticed. In practice, false negatives are more dangerous than false positives, since an undetected attack causes real damage while a false positive only costs analyst time, but tuning detection thresholds to reduce false negatives almost always increases the false positive volume, since looser thresholds catch more real attacks and more benign look-alikes at the same time.

After an incident closes, SOC teams classify the triggering alert into one of four buckets: true positive, correctly caught a real threat; false positive, fired on benign activity; true negative, correctly stayed silent on benign activity, rarely tracked explicitly since it is the default state; or false negative, missed a real threat that surfaced some other way, such as through a later audit or a different alert. This classification feeds directly back into detection engineering: a pattern of false negatives on a particular technique means a new detection rule is needed, while a pattern of false positives on an existing rule means that rule needs tighter conditions or a suppression exception for a known-good workflow.