Disposition
The decision an analyst records to close out an alert or case, classifying it as a true positive, false positive, benign true positive, or escalation. It is the formal conclusion of triage and creates an accountable record.
Concept Neighborhood
Start here
Context Gathering
The foundation Disposition builds on, worth understanding first.
Context GatheringStart here
Collecting the surrounding information an analyst needs to make sense of an alert, the user, host, asset criticality, recent activity, and related events, so triage decisions rest on a full picture rather than the alert alone.
7
lessons
Evidence Collection
Gathering and preserving the data that supports an investigation, logs, artifacts, screenshots, and records, in a sound, documented way so it accurately reflects what happened and can support decisions or later review.
7
lessons
Initial Assessment
An analyst's first evaluation of an alert, quickly judging what it is, how urgent and severe it appears, and what to do next, to triage it efficiently before deeper investigation.
7
lessons
Alert Triage
12
lessons
True Positive
8
lessons
Benign True Positive
7
lessons
Escalation Criteria
7
lessons
Queue Management
7
lessons
Triage Methodology
7
lessons
Show 13 more connections
Related Lessons
7 lessons cover this conceptThe SOC Analyst Role in Depth
SOC Analyst
A Structured Methodology for Alert Triage
SOC Analyst
Investigation Deep Dive: Pivoting Through Telemetry
SOC Analyst
Documentation and Case Management
SOC Analyst
Working with Incident Response and Other Teams
SOC Analyst
Common Alert Categories and Response Playbooks
SOC Analyst
Skills, Certifications, and Career Development
SOC Analyst
Sign in to open lesson content directly.