False positive: scheduled backup flagged as data exfiltration
TKT-0002
Normal
Awaiting SOC
False Positive
- Created By
- d.walker
- Created
- 2026-09-14 19:56
- Last Updated
- 2026-09-15 10:19
- Assigned Analyst
- Emma Richardson
- Category
- False Positive
- Messages
- 8
Conversation
d.walker
Customer
2026-09-14 19:56
We believe the following alert may be a false positive and would like confirmation:
False positive: scheduled backup flagged as data exfiltration
This activity is part of our normal business operations. Could you review and adjust the detection rule if appropriate?
False positive: scheduled backup flagged as data exfiltration
This activity is part of our normal business operations. Could you review and adjust the detection rule if appropriate?
Emma Richardson
SOC Analyst
2026-09-14 22:23
Thank you for raising this. I've reviewed the alert and can confirm we're investigating. I'll update you within the hour.
d.walker
Customer
2026-09-15 01:25
Thanks for the quick response. Can you send me the full timeline when it's ready?
Emma Richardson
SOC Analyst
2026-09-15 02:32
The vulnerability has been added to your remediation tracking. Our next scheduled scan is in 48 hours and will verify the patch was applied successfully.
d.walker
Customer
2026-09-15 03:51
That's reassuring. Can we schedule a call to discuss the remediation steps?
Emma Richardson
SOC Analyst
2026-09-15 05:51
We've applied the policy change you requested. It will take effect within 15 minutes across all monitored endpoints. Please let us know if you see any issues.
d.walker
Customer
2026-09-15 06:49
That's reassuring. Can we schedule a call to discuss the remediation steps?
Emma Richardson
SOC Analyst
2026-09-15 07:25
The alert you referenced (ALR-00023) was generated by our DecoyPulse honeypot system. This has zero false positive rate — the activity is genuine and warrants investigation.