Help Center/ Host Security Service/ FAQs/ Baseline Inspection/ How Do I Determine Whether a Baseline Check Result Is a False Positive?
Updated on 2026-11-05 GMT+08:00
View PDF
Share

How Do I Determine Whether a Baseline Check Result Is a False Positive?

What Is a False Positive?

A check fails even though the actual environment already meets the specified security requirements, or the check item is not applicable to the current target environment (that is, the check result does not match the actual environment).

If you still cannot determine whether the check item is falsely reported, contact technical support for verification. You do not need to make a final determination on your own.

Common False Positive Scenarios

The table below describes common false positive scenarios. Compare your findings against these scenarios. If the criteria are met and supporting evidence is available, you can preliminarily treat the result as a false positive.

Table 1 Common false positives

Scenario

Criteria

The check item is not applicable to the current environment.

The required software component is not installed, or the baseline does not apply to the current host type.

For example, an object is managed by a cluster or cloud management platform that centrally enforces configurations (periodically reverting changes).

The configuration meets requirements, but the check still fails.

When you manually execute the check command specified in the audit description, the command output matches the expected value, but the check reports a failure. (This typically occurs when the configuration format differs from the pattern expected by the check, such as variations in whitespaces, comments, or paths.)

The configuration file is not in the scan path.

The configuration file is in a user-defined path (for example, a user-defined installation directory), but the scan is performed on the default path, which does not cover the actual configuration file.

The configuration has been modified but the service has not been restarted.

This type of check reads the running status of ports, processes, and containers. After the configuration is modified, the service needs to be restarted for the modification to take effect. This is not a false positive. Restart the service and perform the scan again.

Suggestion

  • If the result is a false positive, contact technical support to review the issue. After confirmation, add the check item to the whitelist or adjust the detection logic.
  • If the result is not a false positive, rectify the fault based on the suggestions and verify the fix.
Parent topic: Baseline Inspection