Dispositions

Dispositions describes the overall outcome of the alert/case.

Dispositions are standardized on the Unit21 platform using categories.

For example, a disposition can be called: "BLOCKED", "FRIENDLY FRAUD", "OUTLIER", "BAD RULE", or "FRAUD".

All dispositions must be categorized as a TRUE POSITIVE, UNDETERMINED, UNDER_INVESTIGATION or FALSE POSITIVE.

"FRIENDLY FRAUD" would typically be categorized as a TRUE POSITIVE. The "BAD RULE" disposition is typically categorized as a FALSE POSITIVE and so on.

By default, all pre-exiting dispositions or API inserted dispositions are categorized as UNKNOWN.

What are the benefits of labelling dispositions?

1. Alert Scores are very accurate when alerts are disposed correctly in the Unit21 system.
2. Your organization can easily view alert outcome/performance metrics in Dashboards (Insights).

❗️

DISPOSITION NAMES DO NOT SUPPORT UNDERSCORES.

What do the disposition categories mean?

• 'TRUE_POSITIVE': 'Closing review - took action'
• 'FALSE_POSITIVE_HELPFUL': 'Dismissing this, but it was worth spending the time to look at this'
• 'FALSE_POSITIVE': 'Dismissing this - this should not have reached this stage of the process'
• 'UNDER_INVESTIGATION': 'We are moving this forward in our review process'
• 'UNDETERMINED': 'Not applicable'

The will be available as per the image below:

How do I use dispositions?

1. Your organization must setup dispositions.
2. Your organization must create workflow buttons to dispose alerts and cases.

An alert/case can be disposed only using a workflow button configured in the Workflow Buttons section of your dashboard. Each workflow buttons can have only one disposition.

Dispositions can be viewed in the Summary section of a alert/case view: