False positive rate

False positive rate is the share of a rule's alerts that turn out to be benign. It is the main measure of whether a rule earns its place. A rule with a high rate costs analyst time and teaches people to ignore alerts.

What False positive rate means here

Calculating it needs closed-alert outcomes. Without that data, vendors give estimates. Treat a figure with no sample, period or baseline as a claim.

Rule-level rates are more useful than a platform-wide number, because they show which rules to tune.

Example of False positive rate in Panther documentation

Panther's home page claims 85 percent fewer alerts reaching the queue because outcomes suppress repeat alerts, with no sample, period or baseline published (vendor claim). panther.com read 2026-11-03

Terms related to False positive rate

• Noisy rule: A noisy rule fires far more often than it finds anything real, burying analysts in alerts.
• Tuning: Tuning is adjusting a rule so it keeps its true positives and drops its false ones: tighter conditions, exclusions or thresholds.
• Rule health: Rule health is whether a detection still runs, still sees its data and still earns its alerts.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.