Dispositions describes the overall outcome of the alert/case.

Dispositions are standardized on the Unit21 platform using categories.

For example, a disposition can be called: "BLOCKED", "FRIENDLY FRAUD", "OUTLIER", "BAD RULE", or "FRAUD".

All dispositions must be categorized as a TRUE POSITIVE or FALSE POSITIVE.

"FRIENDLY FRAUD" would typically be categorized as a TRUE POSITIVE. The "BAD RULE" disposition is typically categorized as a FALSE POSITIVE and so on.

By default, all pre-exiting dispositions or API inserted dispositions are categorized as UNKNOWN.

What are the benefits of labelling dispositions?

  1. Alert Scores are very accurate when alerts are disposed correctly in the Unit21 system.
  2. Your organization can easily view alert outcome/performance metrics in Dashboards (Insights).

What do the disposition categories mean?

  • TRUE POSITIVE-> Behavior that is (Fraud, AML, but also for KYC and other use cases - anything corresponding to a positive finding and an action outside of the platform, denying/restricting a user, etc)
  • FALSE POSITIVE -> Anything where the ultimate resolution was no action
  • UNDER INVESTIGATION-> Anything where the ultimate action still is not decided. I.e. even if a case is created, but the ultimate decision might still be to do nothing.
  • NOT APPLICABLE -> Anything where a low-context decision is made. Giving up on very old alerts that are no longer relevant, bulk actions in particular, etc

How do I use dispositions?

  1. Your organization must setup dispositions.
  2. Your organization must create workflow buttons to dispose alerts and cases.

An alert/case can be disposed only using a workflow button configured in the Workflow Buttons section of your dashboard. Each workflow buttons can have only one disposition.

Dispositions can be viewed in the Summary section of a alert/case view:


Did this page help you?