An employee whose authorised transfer you flagged asks what your closed case says about them. What do you answer?

## Why this question is asked at all Most triage teaching treats the alert as the only object of interest. But a benign true positive on user activity has a second subject: a person who did their job correctly and now knows that a security system flagged them and an analyst read their activity. They will ask what was written and who can see it, and the answer an interviewer is listening for shows whether you understand that a disposition is a record about a rule, not a character assessment. ## What the record actually asserts A benign true positive closure asserts two things and nothing more: 1. The detection fired correctly on behaviour that genuinely occurred. 2. That behaviour was verified as authorised. It does not assert that the person was suspected, that they were cleared of anything, or that there was a case against them that failed. Those readings come from careless wording, not from the verdict. ## Wording is the whole obligation Compare two closures of the same case. - *"User was moving unusually large volumes of case files externally; investigated, no proof of wrongdoing found."* - *"Bulk transfer to `partner-legal.example` matched contract reference C-2291; destination tenant and file scope match the contract; confirmed with the records-team manager on 4 March. Disposition: benign true positive."* Both close the case. The first leaves a permanent implication - *unusual*, *no proof* - that a reader six months from now, or a manager pulling case history during a promotion review, will read as smoke. The second is a chain of checkable facts and names an authorisation. The discipline is simple: **record what you verified and how, not what you wondered**. Speculation about motive belongs nowhere in a case that closed as authorised activity. The same discipline protects the investigation quality. A note built from verifiable comparisons is re-testable by the next analyst; a note built from impressions is not. ## Answering the person honestly Things to say plainly: - A detection, not a person, initiated this. Rules fire on shapes of activity; they cannot see contracts. - What the record contains, in substance: the activity, the checks performed, the authorisation found, the verdict. - That the record persists. Closed cases are retained, and the SOC and auditors can read them. Saying "I will delete it" is usually both false and undesirable - the record is what defends both the analyst's work and the employee's authorisation if the transfer is ever questioned again. - That the outcome was *the rule worked*, not *you were nearly in trouble*. Things not to say: that they are now being watched; that the case was closed as a favour; that nothing was recorded. Each is either untrue or creates a worse problem later. ## The second-order benefit Handled well, this conversation buys the SOC something it badly needs: a business team that will answer the phone next time. Analysts verifying an authorisation depend on records, legal and engineering teams responding candidly and fast. A team that has learned a flagged transfer means an accusatory note in a system they cannot see will start routing work around the sanctioned client, or answering carefully rather than helpfully - and the next verification takes days instead of minutes. A team that has seen a factual, respectful closure will confirm the next one in ten minutes. ## Where this stops Who may access which telemetry, approval requirements for investigating an employee, and the notification obligations that a regulated regime imposes are separate matters with their own owners. The narrow, answerable question here is what a closed benign true positive says, how to phrase it so it says only that, and how to tell the subject the truth about it.