Closing Event
Closing event states
Every security event — whether raised by Threat Detection or Application Fingerprinting — ends up in one of five closed states. The state you choose (or that the system chooses automatically) matters beyond record-keeping: several of them directly change what the system learns going forward, so picking the wrong one can quietly retrain detection in the wrong direction.
| State | When to use it | Closed by |
|---|---|---|
| False Positive | The activity was flagged but was not malicious, and it's a pattern you're comfortable having the system suppress going forward — for example, a backup job or a migration tool that looks like bulk encryption. Closing here feeds Application Fingerprinting and Learned Thresholds, so similar activity is less likely to be flagged again. Select a learning scope (this user, this path, this group, or all users) — see Step 1b — Learning Scope. | Manual, or automatically when a Warning-severity event's expiry timer runs out with Learning Mode enabled |
| Close as Threat | Investigation confirmed this was a genuine insider or external bad-actor threat, whether or not it was fully contained. Use Recovery Manager to orchestrate data recovery from snapshots before closing. Creates a permanent, unambiguous incident record — the primary Threat Confirmed metric for tracking ransomware protection outcomes. See Recovery. | Manual |
| Unexpected but Not a Threat | The system was right to flag this — the activity is genuinely unusual for this user or path — but investigation shows it isn't a threat. Distinct from False Positive: you are not asking the system to suppress this pattern in future, because the detection itself was correct — only the intent behind it was benign this time. | Manual |
| Unresolved | Applied automatically when a Warning-severity event's expiry timer runs out before anyone reviews it, with Learning Mode disabled. A record that the event simply timed out, not a judgment on whether it was a threat. | Automatic, on expiry (Warning severity only, Learning Mode disabled) |
| Known Behavior | The event never became an active, human-reviewable event at all — Application Fingerprinting matched it to previously confirmed safe application behavior and closed it immediately. | Automatic, by Application Fingerprinting |
False Positive and Unresolved are easy to conflate but are not interchangeable. False Positive is a statement that the activity wasn't malicious and the system should learn from it. Unresolved is only a statement that nobody reviewed the event before its timer expired — it carries no judgment about whether the activity was malicious.
See Closing an event — the Close Event wizard below for how to select a closing state manually. For the full current-state model (including Threat Assessment, Monitor, Delayed Lockout, and Lockout), see Security Event States.
Closing an event — the Close Event wizard
When you are ready to close an event, click Take an Action → Close Event. This opens the Close Event wizard, a guided multi-step form that classifies the event and executes all final actions atomically.
Step 1 — Select Closing State
Choose exactly one of the three manually-selectable closing states (see Closing event states above for the full five-state model — Unresolved and Known Behavior are applied automatically by the system and are not options here):
| Option | Use when | System effect |
|---|---|---|
| False Positive | The activity was flagged but wasn't malicious, and you want the system to suppress this pattern going forward. | AFP and Learned Thresholds are updated. Learning scope step follows. |
| Close as Threat | Investigation confirmed this was a genuine threat, whether or not it was fully contained. | Event transitions to Threat Confirmed status. No learning applied. |
| Unexpected but Not a Threat | The activity was genuinely unusual, but investigation confirmed it isn't malicious and you don't expect it to recur. | No learning applied. |
Why Close as Threat matters: Close as Threat is the only manually-selected state that produces a Threat Confirmed record — the metric used to measure how often the system actively protected your environment from a real attack. Use it only when you have confirmed malicious activity occurred and was contained or remediated.
Step 1b — Learning Scope (shown only for False Positive)
Define the scope of learning — who and what the system should adapt its detection thresholds for in future:
| Scope | Effect |
|---|---|
| This user | Learned threshold applies to this specific user only. |
| This path | Learned threshold applies to the specific file path involved. |
| Group of users | Learned threshold applies to an AD group. A group picker appears. |
| All users | Learning applied globally. Use with caution. |
Select at least one scope. Multiple scopes can be selected.
Prerequisite for wider scopes: Group of users and All users only appear once the generic threshold feature has been enabled from the CLI (
igls rsw genericthresholds set --enabled=true) — see Applying a learned threshold beyond a single user. Until then, only This user and This path are offered here; the wizard reflects whatever scopes are currently enabled.Best practice: Start with This user or This path. Use All users only when you are certain the pattern is safe across your entire environment.
Step 2 — Confirm User Status Change (shown only if user is locked out)
If the user's access is currently locked, you must either restore access here or explicitly acknowledge that you will handle it separately. You cannot proceed without taking one of these two actions.
Step 3 — Snapshot Cleanup (shown only if snapshots exist)
Lists snapshots associated with this event with creation and expiry dates. Select snapshots to delete. Deletion happens only on final confirmation — not immediately.
Step 4 — Add Comment (optional)
Free-text field for closing notes. A character counter is shown. This comment is saved to the event's Activity Log.
Final step — Review and Confirm
A summary of all selections is shown. Navigate back to any step to make changes. Clicking Confirm executes everything atomically.
On success, the event moves to the History tab. On failure, a specific error is shown and no partial changes are committed — you can safely retry.
See also
- Security Event States — Full state and available-actions reference.
- Recovery — Recover affected data before closing an event as Close as Threat.
- Activity Log Tab — Where closing comments are saved.
- Learning mode explained — How Learned Thresholds and Application Fingerprinting use the learning scope you select here.
- Threat Detections — Overview — Terminology and the severity-by-severity triage workflow.