disposition

disposition

noun

A label that indicates the threat level of a notable event, such as an undetermined or false positive threat. You can use dispositions to classify notable events and separate false positives from true and benign positives without impacting the notable event's status.

For more information

In Use Splunk Enterprise Security:

• Add dispositions to notables