-5

The company I work with has a SIEM which detects when you try to install any software in any workstation. If one of the employees try to install bad software, the SIEM triggers an alert. To circumvent this, my friends in the workplace usually download software from their personal laptops.

Did the SIEM do a false negative in this situation?

4
  • 3
    How are "installing software" and "downloading software from personal laptops" fit together? If a SIEM raises an alert when software is being installed, it does not matter if the software was downloaded on the workstation or on a personal laptop. May 2 '19 at 11:22
  • the personal laptops are connected to the same network as the company,
    – m.Robot
    May 2 '19 at 11:26
  • 1
    A "false negative" of what, exactly? What is the SIEM supposed to report? Is there a gap in detection or reporting? Maybe. But gaps are not a "false negative". That's a different concept.
    – schroeder
    May 2 '19 at 12:33
  • This is actually an MCQ question that i saw...It was really confusing and this is why i put it in a story to get more clarification ... the different options were a) false positive b) true positive c) false negative d) true negative
    – m.Robot
    May 2 '19 at 17:59
2

I think you just have a wrong perception of what your SIEM does/is supposed to do, or how it operates.

The SIEM most likely raises alerts on installation attempts of "bad software" via the OS' audit logs or similar methods. Since personal laptops are no company-managed clients, they most likely do not submit those audit logs to the SIEM, or communicate in other ways with it. Hence they do not trigger an alert. Your SIEM apparently does not check if the download/traffic is malicious, it only checks if employees try to install any software on company equipment, and reports installation attempts of unapproved/"bad" software.

So in short: No, your SIEM did not report false negatives. Your SIEM is just doing its job within its capabilities.

1
  • This is actually an MCQ question that i saw...It was really confusing and this is why i put it in a story to get more clarification ... the different options were a) false positive b) true positive c) false negative d) true negative
    – m.Robot
    May 2 '19 at 16:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.