An elections-office notable is confirmed malicious, but containment is still underway. A clerk sets status to Resolved, thinking that means False Positive. What should the analyst keep separate?
Select an answer to reveal the explanation.
Short Explanation
Status is the ticket's place in line; disposition is the verdict on the analytic. You can be True Positive and still In Progress while you contain. Resolved does not secretly mean False Positive.
Full Explanation
In Enterprise Security, status is workflow (New, In Progress, Pending, Resolved, Closed) and disposition classifies analytic outcome independently. A confirmed malicious elections notable can remain True Positive - Suspicious Activity while status is still In Progress during containment. Resolved means the workflow completed, not that the analytic was a false positive. Claiming status and disposition are the same field so Resolved always means False Positive fails by concept because they are separate controls with different meanings. Saying True Positive notables cannot stay In Progress and must be Closed immediately fails by concept because confirmed malice often remains in progress through remediate. Claiming disposition replaces status so In Progress should be deleted fails by concept because both fields remain part of ES incident handling. Exam caveat: SPLK-5001 tests that analysts keep workflow status and analytic disposition unmerged. Operational check: on the elections notable, set disposition True Positive - Suspicious Activity, leave status In Progress until containment/recover steps finish, then move status to Resolved/Closed without changing a correct True Positive into a False Positive.