False positive
In security detection, a false positive is a result that incorrectly classifies benign activity as malicious or reports a condition that is not actually present.
Start with what the alert says
A false positive depends on the claim the tool made. Did it label benign activity as malicious, or report a vulnerability that wasn’t there? Compare that claim with what actually happened.
An uninvestigated alert is not yet a false positive. An alert about an unusual but authorized event may be doing exactly what its rule was designed to do: ask someone to review it.
The same event can produce two different results
A recovery method changes through an approved request, after the required checks, by an authorized operator. A rule that calls this an unauthorized change has made a false-positive classification.
A rule that simply reports a recovery method changed is correct. The investigation may close without further action, but the detection was accurate.
Check the tradeoff before tuning
Record why you closed the alert so the detection owner can reproduce the finding. Keep unresolved cases separate from confirmed benign ones.
Before adding an exception, test it against both the legitimate workflow and an approved suspicious case. An exception can suppress both. Fewer alerts are useful only if the rule still catches what matters.