A civic analyst correctly assigns False Positive - Incorrect Analytic Logic to a noisy parks notable and then ends the shift. What is still required?

Assigning False Positive - Incorrect Analytic Logic correctly labels a noisy parks notable when the search logic is wrong, but disposition alone does not rewrite the correlation search—analysts must ticket engineering to fix the logic or field mapping. Ending the shift without that handoff leaves the next crew drowning in the same false positives. Believing the disposition automatically rewrites the correlation search fails by concept because disposition is an outcome label on the notable, not a content-management change. Reopening the notable as True Positive so engineering will notice fails by concept because that falsifies the analytic outcome; the right path is an engineering ticket that references the False Positive evidence. Deleting the notable index so the logic cannot fire again fails by concept because destroying history is not how Enterprise Security detections are repaired and it harms auditability for the parks domain. Exam caveat: SPLK-5001 expects False Positive - Incorrect Analytic Logic to drive tuning requests, not silent closure or history deletion. Operational check: file an engineering ticket with sample events and the False Positive disposition, track the search or TA fix, and verify parks notable volume drops after deployment before considering the issue closed.