<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-false-positive-analysis
description: >-
  Systematically investigate, document, tune, and reduce false
  positives including root cause analysis, filter development,
  threshold adjustment, and FP rate tracking.
domain: cybersecurity
subdomain: detection-engineering
tags:
  - false-positive-analysis
  - detection-tuning
  - alert-fatigue
  - fp-reduction
  - filter-development
  - threshold-tuning
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing False Positive Analysis

## Overview

False positive analysis maintains detection efficacy and analyst trust.
Covers systematic FP investigation, root cause categorization, filter
development, threshold optimization, and long-term FP rate tracking.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Alert data | SIEM alert history with disposition |
| Analyst feedback | SOC team input on quality |
| Rule access | Ability to modify detection rules |

## Key Concepts

### FP Investigation Framework

```python
fp_categories = {
    "environmental": "Legitimate software triggering detection",
    "scope_too_broad": "Logic matches more than intended",
    "data_quality": "Log parsing or field mapping issue",
    "threshold_too_low": "Aggregation below normal activity",
    "missing_context": "Lacks enrichment for accurate filtering",
}
fp_tracking = {
    "rule_id": "5e1c0d42", "fp_rate": 0.35,
    "total_alerts": 200, "true_positives": 130, "false_positives": 70,
}
```

## Workflow

1. **Identify high-FP rules** — Sort by FP rate and volume
2. **Sample alerts** — Review representative false positives
3. **Categorize root cause** — Environmental, scope, data, threshold
4. **Develop filters** — Specific exclusions for FP patterns
5. **Adjust thresholds** — Tune aggregation values from baselines
6. **Validate changes** — Verify tuning reduces FPs, keeps TPs
7. **Track improvement** — Monitor FP rate trend after tuning

## Verification

| Check | Method |
|---|---|
| Workflow completed | All steps executed and documented |
| Output validated | Results match expected format and content |
| Quality assured | Peer review or automated validation passed |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
