An elections-office notable is confirmed malicious, but containment is still underway. A clerk sets status to Resolved, thinking that means False Positive. What should the analyst keep separate?
Select an answer to reveal the explanation.
Short Explanation
Status is the ticket's place in line; disposition is the verdict on the analytic. You can be True Positive and still In Progress while you contain. Resolved does not secretly mean False Positive.
Full Explanation
In Enterprise Security, status is workflow (New, In Progress, Pending, Resolved, Closed) and disposition classifies analytic outcome independently. A confirmed malicious elections notable can remain True Positive - Suspicious Activity while status is still In Progress during containment. Resolved means the workflow completed, not that the analytic was a false positive. The two fields must both be maintained; neither replaces the other.