Security Operations · Topic 2 of 7
Alerting, Baselines and Reporting
Tune alerts, weigh false positives and negatives, prioritize by criticality and impact, use behavior baselines and report with useful metrics.
- 4 min
- A false negative is a missed attack and is usually worse than a false positive.
- Loosening a rule reduces false positives but may create false negatives.
- Prioritize by asset criticality, impact, data classification, exposure and confidence.
What it is
An alert is only useful if the right person sees it, trusts it and can act on it. Too many alerts hide the real ones, and too few leave attacks unseen.
This page covers how analysts decide what to look at first, how normal behavior is defined so deviations stand out, and how results are reported to technical teams and management.
How it works
Types of alert outcome
| Outcome | Meaning | Risk |
|---|---|---|
| True positive | A real attack triggered the alert | The goal |
| False positive | A harmless event triggered the alert | Wasted effort and alert fatigue |
| True negative | Nothing bad happened and no alert fired | Normal |
| False negative | An attack happened and no alert fired | The most dangerous, since nobody looks |
Reducing false positives by loosening a rule tends to raise false negatives, so tuning is a trade off. Tune with evidence, such as the share of alerts that were real, and test changes against known attack samples.
Alert failures are a separate problem. A broken log feed, a stopped agent or an expired credential makes a detection silently stop working, so monitor the health of the monitoring system itself.
Prioritization
Analysts cannot handle every alert at once. Prioritize using several factors.
- Asset criticality: an alert on a domain controller outranks one on a lab machine.
- Impact: the possible business damage if the alert is real.
- Data classification: involvement of confidential or regulated data raises priority.
- Exposure and exploitability: internet facing and actively exploited issues come first.
- Confidence: how strongly the evidence supports an attack.
- Residual risk: what remains after existing controls.
A short severity scale, with defined response times for each level, keeps decisions consistent across shifts.
Behavior baselines and analytics
A behavior baseline describes normal activity for a user, device, application or network: usual hours, locations, data volumes and destinations. Deviations from the baseline, such as an account that suddenly downloads far more data than usual, warrant review. User and entity behavior analytics (UEBA) automates this using statistics or machine learning.
Baselines need time to learn and must be updated when the business changes, such as a new office or a seasonal peak. An attacker who moves slowly or uses normal tools may stay inside the baseline, so baselines complement signature and rule based detection and do not replace it.
Deception technologies
Deception places decoys where attackers are likely to look. A honeypot is a fake system, a honeynet is a network of them, and honey tokens are fake credentials, files or database records.
Legitimate users have no reason to touch them, so any access is a strong, low noise signal. They also reveal attacker methods, but must be isolated so they cannot become a stepping stone.
Reporting and metrics
Different audiences need different views.
| Audience | Useful content |
|---|---|
| Analysts | Detailed alerts, queues, search results |
| Security managers | Trends, coverage, workload, aging of issues |
| Executives | Risk in business terms, incidents, progress against goals |
Common measures include mean time to detect (MTTD), mean time to respond (MTTR), the proportion of true positives, number of unpatched critical systems, and coverage of logging and endpoint agents. Key performance indicators (KPIs) show how well processes work, and key risk indicators (KRIs) show how risk is changing. Dashboards should show trends and thresholds and not only counts.
Feeding results back
Every closed alert is feedback. Update rules, add allow list entries for known safe behavior, and record new indicators. Post incident reviews should list which data helped, which was missing and which alerts were too late.
What to remember for the exam
- A false negative is a missed attack and is usually worse than a false positive.
- Loosening a rule reduces false positives but may create false negatives.
- Prioritize by asset criticality, impact, data classification, exposure and confidence.
- Baselines let you detect deviation, but they need learning time and updates.
- Slow or normal looking attacker activity can hide inside a baseline.
- Honeypots and honey tokens give high confidence alerts, because legitimate use is rare.
- Monitor the monitoring system for failed feeds and stopped agents.
- MTTD and MTTR measure detection and response speed, KRIs signal changing risk.
If a question describes any access to a decoy credential or file, treat it as high confidence malicious activity.
Common mistakes
Muting noisy rules without analysis. The noise may hide a real pattern, so adjust thresholds with evidence.
Using one baseline for everyone. Roles differ, so compare users with their peers and with their own history.
Reporting counts without context. One thousand blocked scans mean little without trend and impact.
Forgetting alert fatigue. Analysts stop trusting a queue with mostly false alerts.
Deception systems connected to production networks without isolation can give attackers a foothold, so segment them carefully.
Check yourself
Work through these three questions.
Which alert outcome is most dangerous?
A false negative, because an attack occurs and nobody is alerted.
Why do honey tokens produce reliable alerts?
Legitimate users have no reason to use them, so any access is suspicious.
What does a behavior baseline allow?
It defines normal activity so that deviations, such as unusual data volumes or hours, can be detected.
Topic 2 of 7 in Security Operations
Test yourself on Security Operations
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.