True negative

4.1 Map the provided events to source technologies

📘Cisco Certified CyberOps Associate (200-201 CBROPS)

---

In cybersecurity, when you analyze alerts and events from different security systems, it’s important to classify whether an event is malicious or benign. This helps security analysts respond appropriately and avoid wasting time on non-threats.

1. Definition of True Negative

A True Negative (TN) occurs when:

A security system correctly identifies that an activity is safe or normal and does not raise an alert.

• True: The detection was correct.
• Negative: The event is not malicious.

Example in IT terms:

• A firewall sees a normal HTTP request to a website. The system does not flag it, because it’s legitimate traffic. This is a True Negative.

✅ The key idea: Nothing bad happened, and the system correctly ignored it.

---

2. Why True Negatives Are Important

1. Reduce alert fatigue: Security analysts get many alerts every day. True negatives help prevent unnecessary alerts that would waste analysts’ time.
2. Measure accuracy: When evaluating detection tools (like firewalls, IPS, antivirus), true negatives are used to calculate metrics such as specificity and false positive rate.
3. System tuning: High true negatives indicate the system is correctly ignoring safe activity. If TN is low, the system may be overly sensitive and flag safe activities as threats (leading to false positives).

---

3. True Negative vs Other Event Classifications

Event Type	Definition	Alert Raised?
True Positive (TP)	Malicious activity detected correctly	✅ Yes
False Positive (FP)	Normal activity flagged incorrectly	✅ Yes
False Negative (FN)	Malicious activity missed	❌ No
True Negative (TN)	Normal activity correctly ignored	❌ No

• TN is basically the system saying: “Nothing to worry about here,” and being correct.

---

4. True Negatives in IT Environments

Let’s see how true negatives appear in actual cybersecurity tools:

1. Firewall Logs
   • Allowed traffic that is legitimate and not malicious.
   • Example: Internal user accessing the company intranet correctly.
   • Result: No alert → True Negative.
2. Intrusion Prevention System (IPS)
   • IPS examines packets for attack patterns.
   • Normal traffic that doesn’t match any attack signatures is ignored.
   • Result: True Negative.
3. Antivirus / Endpoint Protection
   • Scans files on a workstation.
   • Clean files that do not contain malware are ignored.
   • Result: True Negative.
4. SIEM (Security Information and Event Management)
   • Aggregates logs from multiple sources.
   • When there’s normal login behavior (no unusual pattern), SIEM doesn’t generate a security incident.
   • Result: True Negative.

---

5. True Negative Metrics

In cybersecurity exams and in practice, TN is used in formulas to measure detection effectiveness:

1. Specificity
   • Measures how well a system avoids false alarms.
   • Formula:
   $$\text{Specificity} = \frac{TN}{TN + FP} \times 100$$Specificity=TN+FPTN​×100
   • Higher specificity → more true negatives → better filtering of normal activity.
2. False Positive Rate
   • Measures how often the system flags normal activity as malicious.
   • Formula:
   $$\text{False Positive Rate} = \frac{FP}{FP + TN} \times 100$$False Positive Rate=FP+TNFP​×100
   • More TN → lower false positive rate → fewer unnecessary alerts.

---

6. Summary – What You Must Remember for the Exam

1. Definition: True Negative = system correctly identifies normal (non-malicious) activity.
2. No alert is generated, because there is nothing malicious.
3. Importance:
   • Reduces alert fatigue
   • Shows system accuracy
   • Helps tune detection tools
4. Examples in IT systems:
   • Firewall allows normal web traffic
   • IPS ignores normal network packets
   • Antivirus ignores clean files
   • SIEM doesn’t flag normal logins
5. Metrics involving TN: Specificity and False Positive Rate.

✅ Tip for the exam: Remember the table of TP, FP, FN, TN – it’s commonly tested with scenarios where you need to classify an event.