WHAT FRAMING SECURITY ALERTS AS A BINARY TRUE OR FALSE POSITIVE IS COSTING YOU

Summary from the TLDR InfoSec newsletter

The true/false positive binaries only capture whether an alert accurately alerts on a signal, but not if it is impactful. The author proposes adding a layer of intent or disposition to alert metrics to measure whether the alert had an actual business impact. This leads to a refined classification with the steps: True Positive - Malicious, True Positive - Suspicious, True Positive - No Business Impact, and False Positive.