{"id":7384,"date":"2026-06-30T11:17:43","date_gmt":"2026-06-30T08:17:43","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=announcement&p=7384"},"modified":"2026-10-19T13:11:59","modified_gmt":"2026-10-19T10:11:59","slug":"new-closed-resolutions","status":"publish","type":"announcement","link":"https:\/\/support.withsecure.com\/en\/announcements\/new-closed-resolutions\/","title":{"rendered":"New Closed Resolutions"},"content":{"rendered":"

Closed Resolutions for Broad Context Detections<\/strong>\u00a0<\/p>\n

Overview<\/strong>\u00a0<\/p>\n

We\u2019re\u00a0introducing new closed resolution types for Broad Context Detections (BCDs). These\u00a0resolutions will replace\u00a0the\u00a0existing Confirmed and Unconfirmed options, giving you a more\u00a0precise\u00a0and consistent way to record outcomes, drive\u00a0automation, and help the\u00a0system improve\u00a0over time.\u00a0<\/p>\n

This article\u00a0explains\u00a0each upcoming resolution, when to use\u00a0it, and how it will affect system\u00a0behavior once\u00a0the\u00a0feature\u00a0is live.\u00a0<\/p>\n

<\/strong><\/p>\n

Closed Resolutions<\/strong>\u00a0<\/p>\n

The\u00a0following resolutions will be\u00a0available\u00a0when closing a BCD. Some\u00a0are\u00a0set manually by the\u00a0user,\u00a0others are\u00a0applied automatically by the\u00a0system.\u00a0<\/p>\n

\n\n\n<\/col>\n<\/col>\n<\/col>\n<\/col>\n<\/colgroup>\n\n\n\n\n\n\n\n
\n

Resolution<\/strong>\u00a0<\/p>\n<\/th>\n

\n

Set by<\/strong>\u00a0<\/p>\n<\/th>\n

\n

Description<\/strong>\u00a0<\/p>\n<\/th>\n<\/tr>\n

\n

Incident<\/strong>\u00a0<\/p>\n<\/td>\n

\n

User\u00a0<\/p>\n<\/td>\n

\n

The\u00a0BCD is a security issue\u00a0and requires action. Select this when you confirm the\u00a0BCD is a true\u00a0incident or unauthorized activity. Use\u00a0this only if you are\u00a0certain that the\u00a0BCD is malicious or needs follow-up.\u00a0<\/p>\n<\/td>\n<\/tr>\n

\n

Inconclusive<\/strong>\u00a0<\/p>\n<\/td>\n

\n

User\u00a0<\/p>\n<\/td>\n

\n

Select this if you cannot\u00a0determine\u00a0whether the\u00a0BCD is a real security issue\u00a0due\u00a0to insufficient information or context. No automatic actions are\u00a0taken\u00a0and the\u00a0BCD is not used for training or automation. Do not use\u00a0this as a default\u00a0option.\u00a0<\/p>\n<\/td>\n<\/tr>\n

\n

False\u00a0Positive<\/strong>\u00a0<\/p>\n<\/td>\n

\n

User\u00a0<\/p>\n<\/td>\n

\n

There is an incident based on normal application behavior or automation that seems like normal safe\u00a0behavior. Closing as false positive helps the system\u00a0learn\u00a0and identical incidents will be closed automatically in the future.\u00a0<\/p>\n<\/td>\n<\/tr>\n

\n

Accepted\u00a0Behavior<\/strong>\u00a0<\/p>\n<\/td>\n

\n

User\u00a0<\/p>\n<\/td>\n

\n

Sometimes false positive incidents that appear\u00a0the\u00a0same have differences in their command-line or\u00a0path\u00a0 parameters\u00a0causing them to be “not identical”. Closing as Accepted\u00a0Behavior\u00a0will offer a wizard to create suppression rules where you can fine tune parameters with wild cards allowing more powerful suppression of false positives.\u00a0<\/p>\n<\/td>\n<\/tr>\n

\n

Auto Accepted\u00a0Behavior<\/strong>\u00a0<\/p>\n<\/td>\n

\n

System\u00a0<\/p>\n<\/td>\n

\n

The\u00a0system closed the\u00a0BCD automatically due\u00a0to a matching suppression rule. The\u00a0BCD\u00a0remains\u00a0visible\u00a0for audit and compliance\u00a0purposes. No user action is\u00a0required, but you can review the\u00a0suppression rules if needed.\u00a0<\/p>\n<\/td>\n<\/tr>\n

\n

Auto False\u00a0Positive<\/strong>\u00a0<\/p>\n<\/td>\n

\n

System\u00a0<\/p>\n<\/td>\n

\n

The\u00a0system closed this BCD automatically\u00a0because\u00a0it matched\u00a0a previous\u00a0false\u00a0positive. No further monitoring is performed. If you\u00a0believe\u00a0the\u00a0ruling was incorrect, you can review your\u00a0previous\u00a0resolutions.\u00a0<\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n

\u00a0\u00a0<\/p>\n

Choosing the\u00a0Right Resolution<\/strong>\u00a0<\/p>\n

Use\u00a0the\u00a0following guidance\u00a0to select the\u00a0most\u00a0appropriate\u00a0resolution:\u00a0<\/p>\n

    \n
  1. Incident \u2013\u00a0<\/strong>use\u00a0when you are\u00a0confident the\u00a0BCD\u00a0represents\u00a0a real attack or unauthorized activity.\u00a0<\/li>\n
  2. Inconclusive\u00a0\u2013\u00a0<\/strong>use\u00a0when you have\u00a0reviewed the\u00a0BCD but cannot\u00a0determine\u00a0whether it is a real threat due\u00a0to missing context.\u00a0<\/li>\n
  3. False\u00a0Positive\u00a0\u2013\u00a0<\/strong>use\u00a0when the\u00a0detection\u00a0was\u00a0wrong, or the\u00a0same\u00a0alert keeps appearing without security relevance.\u00a0<\/li>\n
  4. Accepted\u00a0Behavior \u2013\u00a0<\/strong>use\u00a0when the\u00a0behavior was intentional and authorized (for\u00a0example, a planned admin action), but you do not want to create\u00a0a suppression rule.\u00a0<\/li>\n<\/ol>\n

    Note:\u00a0<\/strong>Avoid using Inconclusive\u00a0as a default. It is intended for cases where\u00a0context is genuinely insufficient. Overuse\u00a0reduces the\u00a0value\u00a0of this resolution for system learning and future\u00a0improvements.<\/em>\u00a0<\/p>\n

    <\/strong><\/p>\n

    How Resolutions Affect System\u00a0Behavior<\/strong>\u00a0<\/p>\n

    Resolutions are\u00a0not just labels. They have\u00a0direct\u00a0effects on automation and future\u00a0detections:\u00a0\u00a0\u00a0<\/p>\n

      \n
    1. BCDs closed as Incident are\u00a0not used to trigger any automatic suppression. They are\u00a0used to improve\u00a0detection accuracy over time.\u00a0<\/li>\n
    2. BCDs closed as Inconclusive\u00a0are\u00a0excluded from training and automation.\u00a0<\/li>\n
    3. BCDs closed as False\u00a0Positive\u00a0may cause\u00a0similar future\u00a0BCDs to\u00a0be\u00a0automatically closed as Auto False\u00a0Positive.\u00a0<\/li>\n
    4. BCDs closed as Accepted\u00a0Behavior can\u00a0be\u00a0used as the\u00a0basis for creating a suppression rule, which will automatically close\u00a0matching future\u00a0BCDs as Auto Accepted\u00a0Behavior.\u00a0<\/li>\n<\/ol>\n

      Note:\u00a0<\/strong>Auto False\u00a0Positive\u00a0is not triggered when\u00a0a previous\u00a0BCD has\u00a0been resolved as Incident. This prevents real threats from\u00a0being automatically dismissed.<\/em>\u00a0<\/p>\n

      <\/strong><\/p>\n

      Suppression Rules and Accepted\u00a0Behavior<\/strong>\u00a0<\/p>\n

      Closing a BCD as Accepted\u00a0Behavior does not automatically suppress similar BCDs in the\u00a0future. To prevent similar BCDs from recurring, you need to create\u00a0a suppression rule.\u00a0<\/p>\n

      When closing a BCD as Accepted\u00a0Behavior, you will\u00a0be\u00a0prompted to create\u00a0a suppression rule\u00a0if the\u00a0BCD\u00a0contains\u00a0recognized unsuppressed key detections. You can also create\u00a0and manage\u00a0suppression rules manually in Security Configurations \u2192 Automated Actions \u2192 Suppression Rules.\u00a0<\/p>\n

      Note:\u00a0<\/strong>For more\u00a0information on suppression rules, see\u00a0the\u00a0Suppression Rules user guide.<\/em>\u00a0<\/p>\n

      <\/strong><\/p>\n

      Email Notifications<\/strong>\u00a0<\/p>\n

      Resolution types affect\u00a0email notification\u00a0behavior as follows:\u00a0<\/p>\n

        \n
      1. Incident \u2013 triggers the\u00a0same\u00a0email notification\u00a0behavior as the\u00a0former Confirmed resolution.\u00a0<\/li>\n
      2. Inconclusive\u00a0\u2013 triggers the\u00a0same\u00a0email notification\u00a0behavior as the\u00a0former Unconfirmed resolution.\u00a0<\/li>\n
      3. All other resolutions follow standard notification\u00a0behavior.\u00a0<\/li>\n<\/ol>\n

        <\/strong><\/p>\n

        Transition from Previous Resolutions<\/strong>\u00a0<\/p>\n

        The\u00a0Confirmed and Unconfirmed resolution types have\u00a0been replaced by the\u00a0resolutions described in this\u00a0article. The\u00a0following mapping applies:\u00a0<\/p>\n

          \n
        1. Confirmed \u2192 use\u00a0Incident for true\u00a0security incidents, or Accepted\u00a0Behavior for authorized activity.\u00a0<\/li>\n
        2. Unconfirmed \u2192 use\u00a0Inconclusive\u00a0when context is insufficient to\u00a0make\u00a0a determination.\u00a0<\/li>\n<\/ol>\n

          BCDs that were\u00a0closed with\u00a0previous\u00a0resolution types\u00a0before\u00a0this change\u00a0are\u00a0not affected. Their resolutions\u00a0remain\u00a0unchanged.\u00a0<\/p>\n

          \u00a0<\/p>\n

          \u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

          Closed Resolutions for Broad Context Detections\u00a0 Overview\u00a0 We\u2019re\u00a0introducing new closed resolution types for Broad Context Detections (BCDs). These\u00a0resolutions will replace\u00a0the\u00a0existing Confirmed and Unconfirmed options, giving you a more\u00a0precise\u00a0and consistent way…<\/p>\n","protected":false},"template":"","announcement_category":[142],"class_list":["post-7384","announcement","type-announcement","status-publish","hentry"],"acf":{"source_system":"vanilla-import","import_hash":"130d3ca2932641dce2ff3697c57de8209495b89d","vanilla_article_id":32986,"legacy_author":"Agnieszka","vanilla_url":"https:\/\/community.withsecure.com\/announcements-en\/kb\/articles\/32986-new-closed-resolutions","vanilla_category_id":142,"machine_translated":false},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement\/7384","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/announcement"}],"version-history":[{"count":1,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement\/7384\/revisions"}],"predecessor-version":[{"id":8884,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement\/7384\/revisions\/8884"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=7384"}],"wp:term":[{"taxonomy":"announcement_category","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement_category?post=7384"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}