MENU
What is a confidence score in regard to IDS/IPS scores?
In Intrusion Detection Systems, false positives (flagging legitimate traffic as an attack) are a major operational headache that cause 'alert fatigue.' To help security analysts prioritize their time, VMware vDefend Threat Intelligence assigns a Confidence Score to its signatures and resulting alerts.
This score specifically represents the system's confidence of the detection being accurate (a true positive). A high confidence score means the signature is highly specific and the context of the traffic almost definitively proves malicious intent, meaning the analyst should act immediately. The 'badness' or potential damage of the threat (Option A) is represented by a separate metric called 'Severity.'