easy5 pts · first answer countsdetection-engineeringalert-triage
What a benign true positive is
A rule for "new local admin account created" fires. The analyst finds an IT engineer created the account for an approved change. How is this alert usually classed?
Discussion 0
Join free to post in the discussion.
Related questions
- IOC vs IOACybersecurity Analyst
- False positive or false negative?Cybersecurity Analyst
- Brute force or password spraying?Cybersecurity Analyst
- What a Tier 1 SOC analyst doesCybersecurity Analyst
- What detection as code gives youCybersecurity Analyst
- The logsource block in a Sigma ruleCybersecurity Analyst
- Reading a selection and filter conditionCybersecurity Analyst
- What the contains modifier doesCybersecurity Analyst