ConceptsDisposition
Disposition
The decision an analyst records to close out an alert or case, classifying it as a true positive, false positive, benign true positive, or escalation. It is the formal conclusion of triage and creates an accountable record.
0 direct links7 lessons
Concept Neighborhood
No connected concepts linked yet.
Related Lessons
7 lessons cover this conceptThe SOC Analyst Role in Depth
SOC Analyst
A Structured Methodology for Alert Triage
SOC Analyst
Investigation Deep Dive: Pivoting Through Telemetry
SOC Analyst
Documentation and Case Management
SOC Analyst
Working with Incident Response and Other Teams
SOC Analyst
Common Alert Categories and Response Playbooks
SOC Analyst
Skills, Certifications, and Career Development
SOC Analyst
Sign in to open lesson content directly.