Which Sources Best Support SIEM False Positive and Negative Analysis?
A company's SIEM is continuously reporting false positives and false negatives. The security operations team has implemented configuration changes to troubleshoot possible reporting errors. Which of the following sources of information best supports the required analysis process? (Choose two.)
Community Insight
The question tests whether you can separate independent validation sources from SIEM-derived metrics; the trap is picking dashboards or trends because they are visible, even though they inherit the same alert logic being tuned.
SIEM false positives and false negatives are best analyzed with sources that are independent of the SIEM's own alert logic. This page establishes that third-party reports and logs plus manual review processes are the correct two sources, while dashboards and trends merely reflect the misconfiguration under investigation.
A common mistake is choosing dashboards or trends because they show alert volume and patterns, but those views are produced by the SIEM whose false positives and negatives are under investigation and cannot independently confirm alert accuracy.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Third-party reports and logs give the SOC an external, independent baseline against which SIEM alerts can be compared; if a third-party log shows no related activity, a suspected false positive is easier to confirm, and if a report identifies activity the SIEM never alerted on, a false negative becomes visible. Manual review processes are equally essential because a human analyst must examine raw events, rule logic, and contextual evidence to decide whether an alert is truly erroneous. Together, A and F support the analysis process without relying on the SIEM's own potentially misconfigured outputs.Why the Other Options Are Wrong
Trends and dashboards (B and C) are visualizations derived from the same SIEM data and alert rules under investigation, so they can repeat the false-positive and false-negative pattern rather than reveal it. Alert failures (D) may point to missed alerts, but failure data is an internal symptom and does not by itself provide an independent standard for judging alert quality. Network traffic summaries (E) can corroborate specific events, but summaries are aggregated and lack the broad external context and human interpretation that third-party reports/logs and manual review provide.Community Comment Notes
The sole community comment, from BWH9492, argues for A and F and warns that internal SIEM dashboards and trends "Reflect misconfigured logic" and therefore cannot serve as independent audit sources. That reasoning aligns with the independent-baseline and human-validation roles of third-party reports/logs and manual review. No commenter defended B, C, D, or E, and the vote count is not a substitute for the analysis.Exam Strategy
Eliminate any option that is a direct output or visualization of the SIEM, such as dashboards and trends, because it cannot independently validate the SIEM's accuracy. Then choose the sources that supply an external baseline and human judgment, which in this scenario are third-party reports/logs and manual review.
Frequently Asked Questions
Why are SIEM dashboards not valid sources for false-positive analysis?
Dashboards are generated from the same SIEM alert logic being investigated, so they show the misconfiguration rather than an independent view of actual activity.
Why is manual review needed when third-party logs are available?
Third-party logs provide external evidence, but a human must interpret context and confirm whether an alert or missed event is truly a false positive or negative.