Suricata search- How to identify a false positive or false negative?

[Jorgelopes]

Hello all

Very new to splunk

Currently analyzing the old botsv1, and its very interesting so far.

I'm stuck when analyzing suricata logs

First of all, how to identify a false positive or false negative?

Second how to identify from the signatures that identified a ransomware which one did actually detected the ransomware.

Thank you all for you comments.

Thank you

[ITWhisperer]

It sounds like you need to understand the Suricata logs - have you tried the Suricata documentation or website or community pages?

[Jorgelopes]

I did had a look at the output of the logs.

What I still don't understand is that if you have 5 events (alert) with severity=1.

How can any of those 5 be a false positive.