Benign True Positive?!?

In short: Is any of you guys using the closure code "Benign True Positive" in your SOC?

And do you have any good source for Industry Standard closure codes (that goes a bit deeper than just FP vs TP vs Duplicate)?

Asking because some folks in my company got the idea to introduce a Closure Code "Benign True Positive". Apparently inspired by [some Microsoft bloggers](https://learn.microsoft.com/en-us/defender-for-identity/understanding-security-alerts).

Their definition: "Alerted activity matched the use case logic as intended, but deeper investigation revealed …

case code cybersecurity definition good industry investigation logic soc standard use case