Dispositions

Dispositions describes the overall outcome of the alert/case.
Dispositions are standardized on the Unit21 platform using categories.
For example, a disposition can be called: "BLOCKED", "FRIENDLY FRAUD", "OUTLIER", "BAD RULE", or "FRAUD".
All dispositions must be categorized as a TRUE POSITIVE, UNDETERMINED, UNDER_INVESTIGATION or FALSE POSITIVE.
"FRIENDLY FRAUD" would typically be categorized as a TRUE POSITIVE. The "BAD RULE" disposition is typically categorized as a FALSE POSITIVE and so on.
By default, all pre-exiting dispositions or API inserted dispositions are categorized as UNKNOWN.
What are the benefits of labelling dispositions?
- Alert Scores are very accurate when alerts are disposed correctly in the Unit21 system.
- Your organization can easily view alert outcome/performance metrics in Dashboards (Insights).
DISPOSITION NAMES DO NOT SUPPORT UNDERSCORES.
What do the disposition categories mean?
- 'TRUE_POSITIVE': 'Closing review - took action'
- 'FALSE_POSITIVE_HELPFUL': 'Dismissing this, but it was worth spending the time to look at this'
- 'FALSE_POSITIVE': 'Dismissing this - this should not have reached this stage of the process'
- 'UNDER_INVESTIGATION': 'We are moving this forward in our review process'
- 'UNDETERMINED': 'Not applicable'
The will be available as per the image below:

How do I use dispositions?
- Your organization must setup dispositions.
- Your organization must create workflow buttons to dispose alerts and cases.
An alert/case can be disposed only using a workflow button configured in the Workflow Buttons section of your dashboard. Each workflow buttons can have only one disposition.
Dispositions can be viewed in the Summary section of a alert/case view:

Updated about 1 month ago