An EDR notable fires on a city software-packaging tool that IT already approved for clerk image builds. The analytic matched real packaging behavior. Which disposition should the analyst assign?
Select an answer to reveal the explanation.
Short Explanation
The detector saw packing behavior and it really was the city's packager on build day. That is not a broken analytic and it is not an attack. Label it Benign Positive - Suspicious But Expected and leave the logic alone.
Full Explanation
When an EDR notable matches real behavior of a city-approved software-packaging tool during clerk image builds, the analytic was correct and the activity was expected—so the disposition is Benign Positive - Suspicious But Expected. That preserves detection value while recording authorized packaging for audit. False Positive - Incorrect Analytic Logic fails by concept because the logic correctly identified packaging behavior; approved software can still match a valid detection without proving the search is broken. True Positive - Suspicious Activity fails by concept because authorized IT packaging on build day is not an incident merely because a packager ran. False Positive - Inaccurate Data fails by concept when host enrichment was fine and the issue is expectedness of approved activity, not a wrong identity binding. Exam caveat: SPLK-5001 dispositions separate wrong logic and bad data from correct detections of authorized activity labeled as benign positive. Operational check: confirm the packaging tool and change window in IT records, assign Benign Positive - Suspicious But Expected, and consider suppression or allow-listing for the approved builder rather than disabling a useful analytic.