Disposition
Disposition is the recorded handling outcome for an alert or finding—distinct from the investigation outcome or final security conclusion.
Disposition
Definition
Disposition is the recorded handling outcome for an alert, ticket, or finding—such as closed benign, closed resolved, escalated, or deferred.
Disposition describes workflow state. It is not identical to investigation outcome (whether the underlying security question was answered) or risk acceptance.
An alert may be dispositioned "closed" while the investigation outcome remains open—a common quality failure.
SentriScope Usage
Investigation workflows distinguish alert handling from investigation conclusions. Reference: KID-INV-0001.
Related Terms
- Finding —
KID-GLS-0008 - Investigation —
KID-GLS-0002 - Evidence —
KID-GLS-0001
Related Knowledge
- Investigation Documentation —
KID-CON-0026 - Investigation Decisions —
KID-CON-0023 - From Alerts to Decisions —
KID-CON-0008