Splunk Disposition

Details

ID	`incident_splunkdisposition`
CLI Name	`splunkdisposition`
Type	singleSelect
Version	-1
Required	No
Read Only	No
Use as KPI	No
Searchable	Yes

Select Values

Unassigned
True positive - suspicious activity
Benign positive - suspicious but expected
False positive - incorrect analytic logic
False positive - inaccurate data
Other
Undetermined

Associated Incident Types

Source

incidentfield-Splunk_Disposition.json

Download History Raw

{
    "associatedToAll": false,
    "associatedTypes": [
        "Splunk Finding",
        "Splunk Investigation"
    ],
    "caseInsensitive": true,
    "cliName": "splunkdisposition",
    "closeForm": false,
    "content": true,
    "description": "The disposition from Splunk.",
    "editForm": true,
    "group": 0,
    "hidden": false,
    "id": "incident_splunkdisposition",
    "isReadOnly": false,
    "locked": false,
    "name": "Splunk Disposition",
    "neverSetAsRequired": false,
    "ownerOnly": false,
    "propagationLabels": [
        "all"
    ],
    "required": false,
    "selectValues": [
        "Unassigned",
        "True positive - suspicious activity",
        "Benign positive - suspicious but expected",
        "False positive - incorrect analytic logic",
        "False positive - inaccurate data",
        "Other",
        "Undetermined"
    ],
    "sla": 0,
    "system": false,
    "threshold": 72,
    "type": "singleSelect",
    "unmapped": false,
    "unsearchable": false,
    "useAsKpi": false,
    "version": -1,
    "fromVersion": "6.0.0",
    "supportedModules": [
        "xsiam",
        "agentix"
    ]
}