thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

True Positive (TP)

An alert that correctly identifies real malicious activity.

Definition

True positives are the desired outcome of detection; they require response. The ratio of true positives to total alerts measures detection fidelity. Some SOCs also track "benign true positives" for real activity that is authorized, such as a penetration test.

Example

An alert for Mimikatz execution that turns out to be an actual attacker.

Exam tip

Know all four outcomes; TP = alert and real threat.

Related terms