blumira-resolutions

# Blumira Resolutions ## Overview Resolutions are the final disposition applied to findings when closing them. Choosing the correct resolution type is critical for accurate security metrics, detection tuning, and compliance reporting. ## Anti-triggers - **Triaging, investigating, assigning, or commenting** — this skill covers only the disposition decision at close. The rest of the lifecycle is `blumira-findings` (or `blumira-msp` for a client account). - **`blumira_resolutions_list`** — that tool enumerates the resolution catalogue and is unrelated to remediation actions; Blumira cannot isolate, block, or kill anything. - **Huntress remediation approve/reject** — superficially similar close-out language, entirely different mechanics (Huntress acts on the endpoint). Use `huntress-incidents`. ## Key Concepts ### Resolution Types | Code | Label | Description | When to Use | |------|-------|-------------|-------------| | 10 | Valid | Confirmed real threat | The finding represents a genuine security event. Action was taken (blocked, remediated, etc.) | | 20 | Not Applicable | Doesn't apply | The detection is correct but irrelevant to this environment (e.g., policy doesn't apply to test lab) | | 30 | False Positive | Incorrect detection | The detection fired incorrectly — the activity was benign | ### Impact on Metrics - **Valid** resolutions count toward your confirmed threat statistics - **False Positive** resolutions feed back into detection tuning — high ...