False negative
In security detection, a false negative occurs when a threat or condition is present but the tool or detection process being evaluated fails to identify it.
When a detection misses something
A false negative means a tool missed a threat it was meant to detect or classified malicious activity as benign. Before calling a result a false negative, check that the activity happened and that the detection was supposed to catch it.
No alert does not always mean a missed detection. The activity may be outside the rule’s scope, or processing may still be within the agreed observation window.
Find where the detection failed
Suppose an approved test changes a recovery method in a way that should trigger a rule. The change is recorded, the required events reach the analytic, and the observation window ends without an alert. That is a missed detection in this test. One test does not tell you the system’s overall miss rate.
Follow the path from event collection through rule matching, alert generation, and analyst response. If an alert fired but nobody investigated, the response failed. If the events never arrived, collection failed and the rule never had the input it needed.
After the owner fixes the problem, repeat the test under comparable conditions. Include a benign case to check that the fix has not introduced unwanted alerts.