Classify the following Wazuh alert as a true positive or false positive.

{
  "timestamp": "2025-03-05T00:42:44.430+0000",
  "rule": {
    "level": 5,
    "description": "sshd: Attempt to login using a non-existent user",
    "id": "5710",
    "mitre": {
      "id": [
        "T1110.001",
        "T1021.004"
      ],
      "tactic": [
        "Credential Access",
        "Lateral Movement"
      ],
      "technique": [
        "Password Guessing",
        "SSH"
      ]
    },
    "firedtimes": 141,
    "mail": false,
    "groups": [
      "syslog",
      "sshd",
      "authentication_failed",
      "invalid_login"
    ],
    "gdpr": [
      "IV_35.7.d",
      "IV_32.2"
    ],
    "gpg13": [
      "7.1"
    ],
    "hipaa": [
      "164.312.b"
    ],
    "nist_800_53": [
      "AU.14",
      "AC.7",
      "AU.6"
    ],
    "pci_dss": [
      "10.2.4",
      "10.2.5",
      "10.6.1"
    ],
    "tsc": [
      "CC6.1",
      "CC6.8",
      "CC7.2",
      "CC7.3"
    ]
  },
  "agent": {
    "id": "xxx",
    "name": "xxx",
    "ip": "xxx.xxx.xxx.xxx"
  },
  "manager": {
    "name": "wazuh-server"
  },
  "id": "1741135364.1048462",
  "full_log": "Mar 05 00:42:42 wazuh-server sshd[3133290]: Disconnected from invalid user tt 103.189.88.237 port 38394 [preauth]",
  "predecoder": {
    "program_name": "sshd",
    "timestamp": "Mar 05 00:42:42",
    "hostname": "wazuh-server"
  },
  "decoder": {
    "parent": "sshd",
    "name": "sshd"
  },
  "data": {
    "srcip": "103.189.88.237",
    "srcport": "38394",
    "srcuser": "tt"
  },
  "location": "journald"
}

Answer: True Positive