SOC / Blue Team · 4 min
Security Alerts
A question, not a verdict
This lesson explains the concept, then checks your understanding in a short interactive exercise.
What an alert actually is
An alert is a system's way of saying 'this matched a pattern worth a human look.' It is a starting point, not a conclusion.
- Alerts are generated by rules or models
- They flag possible interest, not certainty
- Investigation supplies the missing context
Outcomes an alert can turn into
After investigation, an alert usually lands in one of these buckets.
- True positive — the activity was actually malicious or policy-violating
- False positive — the rule matched, but nothing bad happened
- Benign positive — the activity was real but expected and authorized
Loading the interactive lesson…