Classify the following Wazuh alert as a true positive or false positive.

Alert:
{
  "timestamp": "2025-03-05T02:26:52.823+0000",
  "rule": {
    "level": 3,
    "description": "Successful sudo to ROOT executed.",
    "id": "5402",
    "mitre": {
      "id": [
        "T1548.003"
      ],
      "tactic": [
        "Privilege Escalation",
        "Defense Evasion"
      ],
      "technique": [
        "Sudo and Sudo Caching"
      ]
    },
    "firedtimes": 2,
    "mail": false,
    "groups": [
      "syslog",
      "sudo"
    ],
    "pci_dss": [
      "10.2.5",
      "10.2.2"
    ],
    "gpg13": [
      "7.6",
      "7.8",
      "7.13"
    ],
    "gdpr": [
      "IV_32.2"
    ],
    "hipaa": [
      "164.312.b"
    ],
    "nist_800_53": [
      "AU.14",
      "AC.7",
      "AC.6"
    ],
    "tsc": [
      "CC6.8",
      "CC7.2",
      "CC7.3"
    ]
  },
  "agent": {
    "id": "xxx",
    "name": "xxx",
    "ip": "xxx.xxx.xxx.xxx"
  },
  "manager": {
    "name": "wazuh-server"
  },
  "id": "1741141612.1603413",
  "full_log": "Mar 05 02:26:51 wazuh-server sudo[3136638]: godentistinfraservice3nd : TTY=pts/0 ; PWD=/home/godentistinfraservice3nd ; USER=root ; COMMAND=/usr/bin/su",
  "predecoder": {
    "program_name": "sudo",
    "timestamp": "Mar 05 02:26:51",
    "hostname": "wazuh-server"
  },
  "decoder": {
    "parent": "sudo",
    "name": "sudo",
    "ftscomment": "First time user executed the sudo command"
  },
  "data": {
    "srcuser": "godentistinfraservice3nd",
    "dstuser": "root",
    "tty": "pts/0",
    "pwd": "/home/godentistinfraservice3nd",
    "command": "/usr/bin/su"
  },
  "location": "journald"
}

Classification: False Positive