The security analyst acknowledges this alert because it is a false positive. A false positive is an event classification that indicates a benign or normal activity is mistakenly flagged as malicious or suspicious by the SIEM system. A false positive can occur due to misconfigured rules, outdated signatures, or faulty algorithms.
A false positive can waste the security analyst's time and resources, so it is important to acknowledge and dismiss it after verifying that it is not a real threat. Verified References:
* https://www.ibm.com/topics/siem
* https://www.microsoft.com/en-us/security/business/security-101/what-is-siem
* https://www.splunk.com/en_us/data-insider/what-is-siem.html