False Positive or False Negative?

About this interactive

The Monitoring and Alerting lesson separates two jobs. Monitoring is seeing what is happening on the infrastructure: which systems and resources are in use, what is up, what is down or overloaded. Alerting is being told when something goes too far out of bounds, by a dashboard, an email, a text or a call. The lesson's point is that alerting has to be tuned continually, and it names the two ways it goes wrong. A false positive is an alert when there is no real issue. You get paged, look, and find nothing wrong. The danger is what it does to people: after enough of them, alerts get ignored, including the real one. A false negative is a real issue that raised no alert. Something broke and you found out some other way, or too late. The response is to ask what you would need to monitor to have been warned in time. The test for each case: was there an alert, and was there a real problem? An alert with no problem is a false positive. A problem with no alert is a false negative. A problem that is not being monitored at all counts as a false negative too: the lesson's fix is to start monitoring it. The lesson's team met weekly to review alerts for false positives and incidents for missed warnings, and ended up with less noise, faster responses and fewer issues.

What you'll learn

Classify an alerting failure as a false positive (an alert with no real issue) or a false negative (a real issue with no alert)
Explain why both are dangerous: false positives teach people to ignore alerts, and false negatives point to what should be monitored next

Aligned to

CompTIA Security+

4.4 Explain security alerting and monitoring concepts and tools.

Key terms

False Positive: An alert that fires when no actual issue exists, which over time can cause administrators to ignore notifications and reduce monitoring effectiveness.
False Negative: A failure to generate an alert when a real issue exists, leaving problems undetected and unaddressed.
Alerting: The automated notification process that triggers when monitored systems deviate from expected thresholds, informing administrators of potential issues.
Infrastructure Monitoring: The continuous observation of IT infrastructure components—such as servers, applications, and network equipment—to track performance, resource usage, and operational status.

Topics

Monitoring Alerting Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →