There are four types of alert statuses that you might come across. These alerts can indicate everything is operating normally or that a program or operation is behaving suspiciously. The four status types are: false positive, false negative, true negative (false false), and true positive (positive positive):
- False positive: This is often called a "false alarm", or any normal behavior that is seen as malicious or unwanted but isn't. An example of this would be your e-mail service sending a legitimate e-mail to the spam folder instead of your inbox. The detection software got a false positive on your e-mail and, not knowing any better, thought it was unwanted spam.
- False negative: This is the opposite of a false positive, where a malicious or unwanted action slips past. False negatives are much more dangerous than false positives. An example would be an IDS or IPS not recognizing the type...