Dispositions are the reasons an analyst records when they take an action on an alert or case (for example, closing it as a false positive). This article explains how to create your own dispositions, control where they apply, and how they flow into your workflows.
Overview
Custom dispositions let you require an analyst to pick a reason before performing an action, and let you define your own list of reasons for each action. You configure these separately for cases, manual cases, and alerts, which now have their own independent statuses and actions rather than sharing one set.
When an action requires a disposition, the analyst must choose a reason from your configured list before they can complete that action; the configuration is enforced when the status actually changes, not just shown in the interface.
Key concepts
Statuses, actions, and dispositions are configured independently for Cases, Manual cases, and Alerts. A status or action you add to one does not appear on the others.
Each action can require a disposition (yes/no). If required, the analyst must select a reason before the action goes through.
Reasons can be scoped to specific rule types and/or queues, so analysts only see the reasons relevant to what they're reviewing. A reason left unscoped always appears.
Manual cases cannot be scoped by rule type or queue, because a manual case has no originating rule or queue.
Configuring custom dispositions
1. Go to Settings > Case management and scroll to "Statuses, actions & dispositions."
2. Use the tabs to choose what you're configuring: Cases, or Alerts.
3. To add a status, click "Edit statuses," add the new status, and save. It appears as a tag.
4. To add an action, click "Add action" and give it a name. Leave "Require disposition" unchecked if the action needs no reason; the action then shows Disposition: No.
5. To require a reason, check "Require disposition" and add one or more reasons. Scope a reason to a rule type or queue if it should only appear in those contexts, or leave it unscoped to always show.
6. Review the table: it shows each action's disposition setting and reason count. Use the view (eye) and edit (pencil) icons to inspect or change an action.
How it appears to analysts
Once an action with a required disposition is part of a case or alert workflow, performing that action (for example, from the close or escalate dialog) shows a reason dropdown. The dropdown lists only the reasons that match the current rule type or queue, and the analyst cannot submit the action without selecting one. Actions that have no disposition configured behave exactly as before.
