About Jorgelopes

Jorgelopes · ‎03-22-2023

I did had a look at the output of the logs. What I still don't understand is that if you have 5 events (alert) with severity=1. How can any of those 5 be a false positive.

Jorgelopes · ‎03-21-2023

Hello all Very new to splunk Currently analyzing the old botsv1, and its very interesting so far. I'm stuck when analyzing suricata logs First of all, how to identify a false positive or false negative? Second how to identify from the signatures that identified a ransomware which one did actually detected the ransomware. Thank you all for you comments. Thank you

Posts	2
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎03-21-2023

Online Status	Offline
Date Last Visited	‎03-22-2023 08:10 PM

Suricata search- How to identify a false positive ...

Re: Suricata search

Suricata search- How to identify a false positive ...