Dispositions and Subdispositions

800800

Dispositions can be found in the Summary section of a alert/case view:

16001600

Dispositions describes the overall outcome of the alert/case. Examples include FALSE_POSITIVE, CONFIRMED_SUSPICIOUS, and USER_SUSPENDED.

An alert/case can be disposed only using a workflow button configure in the Workflow Buttons section of your dashboard:

16001600

Each workflow buttons can have only one disposition.

Dispose an Alert

  1. From your alert page, select the appropriate workflow button:
16001600
  1. Fill in the prompt:
16001600 16001600
  1. Ensure the disposition has been updated:
16001600

Dispose a Case

  1. From your alert page, select the appropriate workflow button:
16001600
  1. Accept the prompt:
16001600
  1. Ensure the disposition has been updated:
16001600

Subdispositions are also supported

Subdispositions allows for more specific labeling.

Each subdisposition requires options. For example, the disposition closed could have the subdisposition Reason, with the options Not enough info and `false positive.

Subdispositions are configured in the Subdispositions tab of a workflow button. When they are set, the options show up in a dropdown when the agent runs the button action.

16001600

Did this page help you?