Resolutions

---
name: "Blumira Resolutions"
description: >
  Blumira resolution types (Valid, Not Applicable, False Positive): how to choose
  between them, their effect on security metrics and detection tuning, and the
  org- and MSP-level resolve calls.
when_to_use: >-
  When closing a Blumira finding and deciding its disposition. Use when: resolution type, resolve
  finding, false positive, valid finding, not applicable, or close finding.
---

# Blumira Resolutions

## Overview

Resolutions are the final disposition applied to findings when closing them. Choosing the correct resolution type is critical for accurate security metrics, detection tuning, and compliance reporting.

## Anti-triggers

- **Triaging, investigating, assigning, or commenting** — this skill
  covers only the disposition decision at close. The rest of the
  lifecycle is `blumira-findings` (or `blumira-msp` for a client
  account).
- **`blumira_resolutions_list`** — that tool enumerates the resolution
  catalogue and is unrelated to remediation actions; Blumira cannot
  isolate, block, or kill anything.
- **Huntress remediation approve/reject** — superficially similar
  close-out language, entirely different mechanics (Huntress acts on
  the endpoint). Use `huntress-incidents`.

## Key Concepts

### Resolution Types

| Code | Label | Description | When to Use |
|------|-------|-------------|-------------|
| 10 | Valid | Confirmed real threat | The finding represents a genuine security event. Action was taken (blocked, remediated, etc.) |
| 20 | Not Applicable | Doesn't apply | The detection is correct but irrelevant to this environment (e.g., policy doesn't apply to test lab) |
| 30 | False Positive | Incorrect detection | The detection fired incorrectly — the activity was benign |

### Impact on Metrics

- **Valid** resolutions count toward your confirmed threat statistics
- **False Positive** resolutions feed back into detection tuning — high FP rates indicate rules that need adjustment
- **Not Applicable** resolutions help identify rules to disable for specific environments

## API Patterns

### List Available Resolutions

```
blumira_resolutions_list
```

Returns all resolution types with their codes, labels, and descriptions.

### Resolve a Finding

```
blumira_findings_resolve
  finding_id=<UUID>
  resolution_type=10
  notes="Confirmed credential stuffing attack from IP 203.0.113.50. Account locked, password reset forced."
```

### MSP Finding Resolution

```
blumira_msp_findings_resolve
  account_id=<UUID>
  finding_id=<UUID>
  resolution_type=30
  notes="False positive - scheduled backup job triggers this detection. Added to allowlist."
```

## Common Workflows

### Choosing the Right Resolution

1. **Is the detected activity real?**
   - Yes → Was it malicious or a policy violation? → **Valid (10)**
   - Yes → But it's expected/allowed in this environment → **Not Applicable (20)**
   - No → The detection was wrong → **False Positive (30)**

2. Always include detailed notes explaining the decision
3. For False Positives, note what the activity actually was to help with tuning

### Bulk Resolution of False Positives

1. `blumira_findings_list` filtered by the specific detection rule
2. Review a sample to confirm all are false positives
3. Resolve each with resolution type 30 and consistent notes
4. Consider requesting a rule tuning in the Blumira portal

## Error Handling

### Invalid Resolution Type

**Cause:** Resolution code is not 10, 20, or 30
**Solution:** Use `blumira_resolutions_list` to confirm valid codes.

### Missing Notes

**Cause:** Some resolution workflows may require notes
**Solution:** Always provide descriptive notes for audit trail purposes.

## Best Practices

- Track false positive rates by detection rule to identify tuning opportunities
- Use "Not Applicable" instead of "False Positive" when the detection is correct but the policy doesn't apply
- Review resolution statistics regularly to improve detection quality
- For MSP accounts, maintain consistent resolution standards across tenants

## Related Skills

- [Findings](../findings/SKILL.md) — Finding lifecycle and resolution workflow
- [MSP](../msp/SKILL.md) — Cross-account resolution management