Closed Resolutions for Broad Context Detections
Overview
We’re introducing new closed resolution types for Broad Context Detections (BCDs). These resolutions will replace the existing Confirmed and Unconfirmed options, giving you a more precise and consistent way to record outcomes, drive automation, and help the system improve over time.
This article explains each upcoming resolution, when to use it, and how it will affect system behavior once the feature is live.
Closed Resolutions
The following resolutions will be available when closing a BCD. Some are set manually by the user, others are applied automatically by the system.
Resolution | Set by | Description |
|---|
Incident | User | The BCD is a security issue and requires action. Select this when you confirm the BCD is a true incident or unauthorized activity. Use this only if you are certain that the BCD is malicious or needs follow-up. |
Inconclusive | User | Select this if you cannot determine whether the BCD is a real security issue due to insufficient information or context. No automatic actions are taken and the BCD is not used for training or automation. Do not use this as a default option. |
False Positive | User | There is an incident based on normal application behavior or automation that seems like normal safe behavior. Closing as false positive helps the system learn and identical incidents will be closed automatically in the future. |
Accepted Behavior | User | Sometimes false positive incidents that appear the same have differences in their command-line or path parameters causing them to be "not identical". Closing as Accepted Behavior will offer a wizard to create suppression rules where you can fine tune parameters with wild cards allowing more powerful suppression of false positives. |
Auto Accepted Behavior | System | The system closed the BCD automatically due to a matching suppression rule. The BCD remains visible for audit and compliance purposes. No user action is required, but you can review the suppression rules if needed. |
Auto False Positive | System | The system closed this BCD automatically because it matched a previous false positive. No further monitoring is performed. If you believe the ruling was incorrect, you can review your previous resolutions. |
Choosing the Right Resolution
Use the following guidance to select the most appropriate resolution:
- Incident – use when you are confident the BCD represents a real attack or unauthorized activity.
- Inconclusive – use when you have reviewed the BCD but cannot determine whether it is a real threat due to missing context.
- False Positive – use when the detection was wrong, or the same alert keeps appearing without security relevance.
- Accepted Behavior – use when the behavior was intentional and authorized (for example, a planned admin action), but you do not want to create a suppression rule.
Note: Avoid using Inconclusive as a default. It is intended for cases where context is genuinely insufficient. Overuse reduces the value of this resolution for system learning and future improvements.
How Resolutions Affect System Behavior
Resolutions are not just labels. They have direct effects on automation and future detections:
- BCDs closed as Incident are not used to trigger any automatic suppression. They are used to improve detection accuracy over time.
- BCDs closed as Inconclusive are excluded from training and automation.
- BCDs closed as False Positive may cause similar future BCDs to be automatically closed as Auto False Positive.
- BCDs closed as Accepted Behavior can be used as the basis for creating a suppression rule, which will automatically close matching future BCDs as Auto Accepted Behavior.
Note: Auto False Positive is not triggered when a previous BCD has been resolved as Incident. This prevents real threats from being automatically dismissed.
Suppression Rules and Accepted Behavior
Closing a BCD as Accepted Behavior does not automatically suppress similar BCDs in the future. To prevent similar BCDs from recurring, you need to create a suppression rule.
When closing a BCD as Accepted Behavior, you will be prompted to create a suppression rule if the BCD contains recognized unsuppressed key detections. You can also create and manage suppression rules manually in Security Configurations → Automated Actions → Suppression Rules.
Note: For more information on suppression rules, see the Suppression Rules user guide.
Email Notifications
Resolution types affect email notification behavior as follows:
- Incident – triggers the same email notification behavior as the former Confirmed resolution.
- Inconclusive – triggers the same email notification behavior as the former Unconfirmed resolution.
- All other resolutions follow standard notification behavior.
Transition from Previous Resolutions
The Confirmed and Unconfirmed resolution types have been replaced by the resolutions described in this article. The following mapping applies:
- Confirmed → use Incident for true security incidents, or Accepted Behavior for authorized activity.
- Unconfirmed → use Inconclusive when context is insufficient to make a determination.
BCDs that were closed with previous resolution types before this change are not affected. Their resolutions remain unchanged.