True positive
noun · also TP · Microsoft Learn: Manage incidents in the Microsoft Defender portal
An alert that correctly flags real malicious activity: the detection worked and the threat is genuine, so it needs a response.
Every alert ends with a verdict. A true positive means two things are right at once: the activity the rule looked for really happened, and it really was malicious. That is the case that needs action, from removing a phishing email to isolating a device.
It sits beside three other outcomes. A false positive is an alert on harmless activity that the rule mistook for an attack. A benign positive is real activity that was authorized, such as a penetration test. A false negative is an attack that raised no alert at all. Microsoft Defender XDR records the first three when you classify an incident as True positive, False positive or Informational, expected activity.
Example
An alert reports that Word started PowerShell with an encoded command. The analyst decodes it and finds a script that downloads a remote access tool from a newly registered domain. The alert is a true positive: the device is isolated and an investigation begins.
Why it matters for a SOC analyst
Classifying alerts accurately is how a SOC measures and improves its detections. A rule with many true positives is worth its noise; one that never produces them needs tuning or removal. Record the verdict, and the threat type, every time you close an alert.
Related terms
- False positive
An alert that fires on activity that is not actually malicious, because the detection logic matched something legitimate.
- Alert triage
The first quick assessment of a security alert or incident: is it real, how serious is it, and what needs to happen next and how soon.
- Security operations center
The team, processes and tools that monitor an organization around the clock, investigate alerts and coordinate the response to incidents.
- Incident response
The organized process of detecting, analyzing, containing, eradicating and recovering from a security incident, then learning from it.