Classify the following Wazuh alert as a true positive or false positive.

{
  "timestamp": "2025-03-05T01:54:03.537+0000",
  "rule": {
    "level": 3,
    "description": "Host Blocked by firewall-drop Active Response",
    "id": "651",
    "firedtimes": 28,
    "mail": false,
    "groups": [
      "ossec",
      "active_response"
    ],
    "pci_dss": [
      "11.4"
    ],
    "gpg13": [
      "4.13"
    ],
    "gdpr": [
      "IV_35.7.d"
    ],
    "nist_800_53": [
      "SI.4"
    ],
    "tsc": [
      "CC6.1",
      "CC6.8",
      "CC7.2",
      "CC7.3",
      "CC7.4"
    ]
  },
  "agent": {
    "id": "xxx",
    "name": "xxx",
    "ip": "xxx.xxx.xxx.xxx"
  },
  "manager": {
    "name": "wazuh-server"
  },
  "id": "1741139643.1504004",
  "full_log": "2025/03/05 08:54:02 active-response/bin/firewall-drop: {\"version\":1,\"origin\":{\"name\":\"node01\",\"module\":\"wazuh-execd\"},\"command\":\"add\",\"parameters\":{\"extra_args\":[],\"alert\":{\"timestamp\":\"2025-03-05T01:54:02.794+0000\",\"rule\":{\"level\":5,\"description\":\"sshd: Attempt to login using a non-existent user\",\"id\":\"5710\",\"mitre\":{\"id\":[\"T1110.001\",\"T1021.004\"],\"tactic\":[\"Credential Access\",\"Lateral Movement\"],\"technique\":[\"Password Guessing\",\"SSH\"]},\"firedtimes\":11,\"mail\":false,\"groups\":[\"syslog\",\"sshd\",\"authentication_failed\",\"invalid_login\"],\"gdpr\":[\"IV_35.7.d\",\"IV_32.2\"],\"gpg13\":[\"7.1\"],\"hipaa\":[\"164.312.b\"],\"nist_800_53\":[\"AU.14\",\"AC.7\",\"AU.6\"],\"pci_dss\":[\"10.2.4\",\"10.2.5\",\"10.6.1\"],\"tsc\":[\"CC6.1\",\"CC6.8\",\"CC7.2\",\"CC7.3\"]},\"agent\":{\"id\":\"000\",\"name\":\"wazuh-server\"},\"manager\":{\"name\":\"wazuh-server\"},\"id\":\"1741139642.1500160\",\"full_log\":\"Mar 05 01:54:00 wazuh-server sshd[3135647]: Disconnected from invalid user roots 43.252.103.253 port 60826 [preauth]\",\"predecoder\":{\"program_name\":\"sshd\",\"timestamp\":\"Mar 05 01:54:00\",\"hostname\":\"wazuh-server\"},\"decoder\":{\"parent\":\"sshd\",\"name\":\"sshd\"},\"data\":{\"srcip\":\"43.252.103.253\",\"srcport\":\"60826\",\"srcuser\":\"roots\"},\"location\":\"journald\"},\"program\":\"active-response/bin/firewall-drop\"}}",
  "decoder": {
    "parent": "ar_log_json",
    "name": "ar_log_json"
  },
  "data": {
    "srcip": "43.252.103.253",
    "version": "1",
    "origin": {
      "name": "node01",
      "module": "wazuh-execd"
    },
    "command": "add",
    "parameters": {
      "extra_args": [],
      "alert": {
        "timestamp": "2025-03-05T01:54:02.794+0000",
        "rule": {
          "level": "5",
          "description": "sshd: Attempt to login using a non-existent user",
          "id": "5710",
          "mitre": {
            "id": [
              "T1110.001",
              "T1021.004"
            ],
            "tactic": [
              "Credential Access",
              "Lateral Movement"
            ],
            "technique": [
              "Password Guessing",
              "SSH"
            ]
          },
          "firedtimes": "11",
          "mail": "false",
          "groups": [
            "syslog",
            "sshd",
            "authentication_failed",
            "invalid_login"
          ],
          "gdpr": [
            "IV_35.7.d",
            "IV_32.2"
          ],
          "gpg13": [
            "7.1"
          ],
          "hipaa": [
            "164.312.b"
          ],
          "nist_800_53": [
            "AU.14",
            "AC.7",
            "AU.6"
          ],
          "pci_dss": [
            "10.2.4",
            "10.2.5",
            "10.6.1"
          ],
          "tsc": [
            "CC6.1",
            "CC6.8",
            "CC7.2",
            "CC7.3"
          ]
        },
        "agent": {
          "id": "000",
          "name": "wazuh-server"
        },
        "manager": {
          "name": "wazuh-server"
        },
        "id": "1741139642.1500160",
        "full_log": "Mar 05 01:54:00 wazuh-server sshd[3135647]: Disconnected from invalid user roots 43.252.103.253 port 60826 [preauth]",
        "predecoder": {
          "program_name": "sshd",
          "timestamp": "Mar 05 01:54:00",
          "hostname": "wazuh-server"
        },
        "decoder": {
          "parent": "sshd",
          "name": "sshd"
        },
        "data": {
          "srcip": "43.252.103.253",
          "srcport": "60826",
          "srcuser": "roots"
        },
        "location": "journald"
      },
      "program": "active-response/bin/firewall-drop"
    }
  },
  "location": "/var/ossec/logs/active-responses.log"
}

Answer: False Positive