CompTIA CySA+ (CS0-003)Reporting and CommunicationEasy
During a monthly security review, a security analyst notes a consistent increase in the number of security alerts generated by the Intrusion Detection System (IDS) that are later classified as false positives. The analyst needs to report this trend to the security operations center (SOC) manager to suggest improvements. Which of the following metrics would BEST illustrate the impact of this trend on SOC efficiency?
- AMean time to respond (MTTR) to critical alerts.
- BFalse Positive Rate (FPR) of the IDS.
- CTotal number of IDS alerts per day.
- DNumber of unique attack signatures triggered.
Show answer & explanationAnswer & explanation
Correct answer: B. False Positive Rate (FPR) of the IDS.
The False Positive Rate (FPR) directly measures the proportion of benign alerts that are incorrectly identified as malicious. A consistent increase in false positives will significantly impact SOC efficiency by wasting analyst time on non-threats. Reporting the FPR clearly quantifies this problem.
Why the other options are wrong
- A. MTTR is important for legitimate incidents, but it doesn't directly address the problem of time wasted on false positives, which is the core issue here.
- C. While the total number of alerts might be high, it doesn't differentiate between legitimate threats and false positives, thus not clearly showing the inefficiency issue.
- D. The number of unique attack signatures doesn't directly indicate the problem of false positives or the efficiency impact of processing them.
False Positive Rate (FPR)
A metric representing the proportion of non-malicious events that are incorrectly identified as malicious by a security system, often leading to alert fatigue and wasted resources.
- Calculated as (False Positives) / (False Positives + True Negatives).
- High FPR indicates inefficiency and alert fatigue.
- Crucial for evaluating the effectiveness and tuning of detection systems.
Memory trick: SOC Efficiency: Focus on 'False' alarms, not just 'Total' noise.