@tazwake We categorize alerts into false positive, true positive or anomalous safe. For an alert that triggers a detection, but the activity is known/approved, we classify as anomalous safe. Classifying as a true positive skews metrics and makes reporting difficult to explain.