Glossary

The decision an analyst records to close out an alert or case, classifying it as a true positive, false positive, benign true positive, or escalation. It is the formal conclusion of triage and creates an accountable record.

Every alert an analyst works ends in a disposition: a documented judgment of what it was and what was done. Common dispositions include true positive (real threat), false positive (not what it looked like), benign true positive (real but expected activity), and escalation to incident response. Recording dispositions consistently produces the metrics, audit trail, and tuning feedback that let a SOC measure itself and improve its detections.

Introduced in: SOC Analyst Fundamentals

No related terms linked yet.