The Wise Verdict represents the Investigation Agent's assessment of the alert. Review the verdict and determine how to proceed with the investigation.
Wise verdict | Description | Action |
|---|---|---|
True Positive | The evidence supports a real threat. | Review the recommended response actions in the Actions panel. Contain the threat, then close the investigation. |
False Positive | The evidence does not support a real threat. | Confirm the assessment and close the investigation. Your feedback helps improve the recognition of similar activity in future alerts. |
Inconclusive | The evidence does not clearly confirm or rule out a threat. | Review the Evidence, Assets, and Thought Process tabs for gaps. Gather additional evidence if needed. Keep the investigation open for further review or close it with your assessment. |
Pending or | The Investigation Agent has not completed the investigation. The Analyzing status appears while the agent processes the investigation. | Wait for the investigation to complete. No action is required until the verdict is updated. |
The Investigation Agent evaluates technical, behavioral, and impact data from Evidence, users, hosts, and IP addresses from Assets, and adversary tactics and techniques from MITRE ATT&CK. It evaluates this information against multiple hypotheses and assigns a confidence level based on the evidence supporting the assessment.