An EDR notable fires on a city software-packaging tool that IT already approved for clerk image builds. The analytic matched real packaging behavior. Which disposition should the analyst assign?
Select an answer to reveal the explanation.
Short Explanation
The detector saw packing behavior and it really was the city's packager on build day. That is not a broken analytic and it is not an attack. Label it Benign Positive - Suspicious But Expected and leave the logic alone.
Full Explanation
Enterprise Security dispositions classify analytic outcome independently of workflow status. Benign Positive - Suspicious But Expected is correct when the correlation search fired on real matching activity that is authorized or expected, such as an approved city software-packaging tool. False Positive - Incorrect Analytic Logic is for a broken search; False Positive - Inaccurate Data is for wrong telemetry identity. True Positive - Suspicious Activity is for unexpected malicious or suspicious activity, not an approved packaging job.