I would like an explanation on Sentinel's case closure.

Question

I would like an explanation on Sentinel's case closure.

Answer 1

@Koonnamchok Klongkaew I understand that you are looking for explanations of the case closure reasons in Sentinel. I'm not sure if you are looking for criteria for choosing one of the categories or explanations of the category types, so I will try to provide both. Some of these descriptions are covered in the Sentinel documentation and the security alert documentation.

True positive - suspicious activity - If you performed an investigation of a security issue and determined that the root cause was an actual threat, you can choose this category once you have remediated the issue.

Benign positive - suspicious but expected - An action detected by Defender for Identity that is real, but not malicious, such as a penetration test or known activity generated by an approved application. A good example of this would be when someone elevates access to deploy a legitimate change. In most scenarios you would want to be notified about the elevated access, but in legitimate cases, this elevation would trigger a benign positive.

False positive - incorrect alert logic - You can select this classification if you believe that the Analytics Rule logic that triggered the alert was configured incorrectly. This can be caused by your own misconfigured rules or by a misconfiguration in a template you were using.

Undetermined - You should choose this category only if you are truly unable to determine what caused the incident, or if you think you might get a similar incident later but do not have enough info in the current one. This category should only be chosen in rare circumstances since ideally you should investigate the incidents and determine the root cause.

Let me know if this helps and if you have futher questions.

If the information helped you, please Accept the answer. This will help us as well as others in the community who may be researching similar questions.