Alert severity is not the disposition

Severity is copied from the rule

Severity is the label the rule carries, such as Low, Medium, or High. The alert shows that label so the queue can sort. It is not a decision about this firing, and it is not a count of events.

Two alerts can share High and still need two decisions. The word does not close either one.

Disposition is the decision field

Disposition, when your queue has it, is where an analyst records true positive, false positive, or another outcome your team defined. That word is written by a person or by a workflow you can name. It is not computed from the severity label.

If the field is empty, no decision has been stored. Do not backfill it from High or from Low.

Keep the two words apart

File severity as the rule label and disposition as the decision, or as not set. A sentence that says the alert is a true positive has to point at the disposition field, not at the severity.

Lab: High with no disposition

A lab alert for HB-DET-014 shows severity High. The disposition field is empty. A draft closes it as a true positive because High means the rule already decided.

The note says severity High and disposition not set. High remains the queue label. The true-positive sentence is removed until a decision is actually recorded.

Snippet

rule id: HB-DET-014
severity: High
disposition: empty
write: label High, decision not set
not: true positive because of High

Diagram

Two words that do not decide each other

High sorts the queue. It does not close the alert.

Severity
The label from the rule, copied onto the alert.
Disposition
The decision field, filled when someone records an outcome.
Empty disposition
No decision is stored. Say it is not set.
A later decision
Goes in the disposition field, and it can disagree with the label.

Check yourself

1. The alert shows severity High and no disposition. What is High?

2. Where does a true-positive call belong?

3. Disposition is still empty. What may you claim?