A civic analyst correctly assigns False Positive - Incorrect Analytic Logic to a noisy parks notable and then ends the shift. What is still required?
Select an answer to reveal the explanation.
Short Explanation
Stamping False Positive - Incorrect Analytic Logic tells the truth about the parks notable. It does not rewrite the search. Send engineering a ticket, or the same broken logic greets the next shift.
Full Explanation
Disposition records that the parks notable fired because analytic logic is wrong. Tuning the correlation search, field mapping, or trigger is Engineer work that the analyst must request; the disposition field does not change content by itself. Relabeling the notable True Positive hides the defect. Deleting notable history is not how ES detections are repaired.