Investigation confirms credential stuffing against the utilities payment portal that the city did not authorize. Which disposition should the analyst assign?
Select an answer to reveal the explanation.
Short Explanation
They stuffed credentials at the utilities portal and the city did not ask for that test. That is True Positive - Suspicious Activity. 'Portals get stuffed' is not an authorized exception, and you are past Undetermined once it is confirmed.
Full Explanation
True Positive - Suspicious Activity is the official disposition for confirmed unexpected malicious or suspicious activity. Credential stuffing against the utilities portal that was not authorized meets that bar. Benign Positive is reserved for detections that correctly match expected, approved activity. Portal logs are valid notable sources, and Undetermined is only appropriate before analysis supports a final label.