Skip to main content
Sub-dispositions let you extend Corsa’s standard alert and case statuses with custom resolution reasons. For example, a RESOLVED alert can carry a sub-disposition of true_positive_filed_sar or false_positive_rule_tuning so analysts capture the specific outcome without losing the normalized parent status. Full API endpoint details are available in the API Reference (requires API credentials).

​
Overview

Each sub-disposition belongs to:
  • A parent status — the standard Corsa status it qualifies (RESOLVED, ESCALATED, CLOSED_DISMISSED, or CLOSED_ESCALATION_TO_SAR)
  • An entity type — either ALERT or CASE
Sub-dispositions can be preset (system-defined, always available) or custom (created via API). Custom sub-dispositions can be toggled active/inactive without deletion, preserving historical audit data. Parent statuses:
StatusApplies to
RESOLVEDAlerts and Cases
ESCALATEDAlerts and Cases
CLOSED_DISMISSEDCases
CLOSED_ESCALATION_TO_SARCases

​
List Sub-Dispositions

Endpoint: GET /v1/sub-dispositions Returns all sub-dispositions (preset and custom) for the platform. 
GET /v1/sub-dispositions

const subDispositions = await corsa.subDispositions.listSubDispositions();

from corsa_sdk.api.sub_dispositions.list_sub_dispositions import _get_kwargs

resp = http.request(**_get_kwargs())
sub_dispositions = resp.json()

​
Create a Sub-Disposition

Endpoint: POST /v1/sub-dispositions 
POST /v1/sub-dispositions
Content-Type: application/json

{
  "name": "false_positive_rule_tuning",
  "displayName": "False Positive — Rule Tuning",
  "parentStatus": "RESOLVED",
  "entityType": "ALERT"
}

const subDisposition = await corsa.subDispositions.createSubDisposition({
  name: "false_positive_rule_tuning",
  displayName: "False Positive — Rule Tuning",
  parentStatus: "RESOLVED",
  entityType: "ALERT",
});

from corsa_sdk.api.sub_dispositions.create_sub_disposition import _get_kwargs
from corsa_sdk.models.create_sub_disposition_dto import CreateSubDispositionDto

resp = http.request(**_get_kwargs(
    body=CreateSubDispositionDto(
        name="false_positive_rule_tuning",
        display_name="False Positive — Rule Tuning",
        parent_status="RESOLVED",
        entity_type="ALERT",
    ),
))
sub_disposition = resp.json()

​
Request Fields

FieldRequiredDescription
nameYesInternal key in lower_snake_case — used in API requests and exports
parentStatusYesThe parent status this sub-disposition qualifies: RESOLVED, ESCALATED, CLOSED_DISMISSED, or CLOSED_ESCALATION_TO_SAR
entityTypeYesEntity this applies to: ALERT or CASE
displayNameNoHuman-readable label shown to analysts. Defaults to title-cased name if omitted

​
Get a Sub-Disposition

Endpoint: GET /v1/sub-dispositions/{id} 
GET /v1/sub-dispositions/sd_abc123

const subDisposition = await corsa.subDispositions.getSubDisposition("sd_abc123");

from corsa_sdk.api.sub_dispositions.get_sub_disposition import _get_kwargs

resp = http.request(**_get_kwargs(id="sd_abc123"))
sub_disposition = resp.json()

​
Update a Sub-Disposition

Endpoint: PATCH /v1/sub-dispositions/{id} You can update the display name or toggle the active state. Custom sub-dispositions cannot have their name, parentStatus, or entityType changed after creation. 
PATCH /v1/sub-dispositions/sd_abc123
Content-Type: application/json

{
  "displayName": "False Positive — Rule Needs Tuning",
  "isActive": true
}

const updated = await corsa.subDispositions.updateSubDisposition("sd_abc123", {
  displayName: "False Positive — Rule Needs Tuning",
  isActive: true,
});

from corsa_sdk.api.sub_dispositions.update_sub_disposition import _get_kwargs
from corsa_sdk.models.update_sub_disposition_dto import UpdateSubDispositionDto

resp = http.request(**_get_kwargs(
    id="sd_abc123",
    body=UpdateSubDispositionDto(
        display_name="False Positive — Rule Needs Tuning",
        is_active=True,
    ),
))
updated = resp.json()

​
Delete a Sub-Disposition

Endpoint: DELETE /v1/sub-dispositions/{id} Soft-deletes the sub-disposition. Only custom sub-dispositions can be deleted — preset sub-dispositions cannot be removed. 
DELETE /v1/sub-dispositions/sd_abc123

await corsa.subDispositions.deleteSubDisposition("sd_abc123");

from corsa_sdk.api.sub_dispositions.delete_sub_disposition import _get_kwargs

http.request(**_get_kwargs(id="sd_abc123"))

​
Sub-Disposition Response Object

{
  "id": "sd_abc123",
  "platformId": "platform_xyz",
  "name": "false_positive_rule_tuning",
  "displayName": "False Positive — Rule Tuning",
  "parentStatus": "RESOLVED",
  "entityType": "ALERT",
  "isPreset": false,
  "isActive": true,
  "createdAt": "2024-01-15T10:00:00Z",
  "updatedAt": "2024-01-15T10:00:00Z"
}