How do you decide whether an alert is a true positive or a false positive?

A true positive means the detection logic fired on the behavior it was designed to catch. Decide by reconstructing what actually happened on the host, not by whether it turned out to be malicious. Malicious activity is a separate axis, which is why benign true positive exists as a verdict. Use process lineage, user intent, change records and baseline comparison, then record the evidence that drove the call.

I keep two questions separate. Did the rule fire on what it was written to catch, and was that behavior malicious. If a rule for remote service creation fires because a sysadmin used PsExec during a patch window, that is a true positive on the detection and benign in intent. Calling it a false positive is how you end up suppressing PsExec entirely and missing the real one six months later. Practically, I rebuild the sequence: parent process, command line, the account, the time, whether it lines up with a change record, and whether the same pattern shows up on peer machines. If ninety machines in the same organizational unit did it within five minutes, it is almost certainly automation. If it is one host at three in the morning with an interactive logon, I escalate. I always write down the specific evidence that would change my mind, because on the next shift somebody else may be the one who finds it.