Splunk Disposition

The disposition from Splunk.

Splunk singleSelect

Details

IDincident_splunkdisposition
CLI Namesplunkdisposition
TypesingleSelect
Version-1
RequiredNo
Read OnlyNo
Use as KPINo
SearchableYes

Select Values

  • Unassigned
  • True positive - suspicious activity
  • Benign positive - suspicious but expected
  • False positive - incorrect analytic logic
  • False positive - inaccurate data
  • Other
  • Undetermined

Associated Incident Types