# False-positive closure referral brief template | SourceX

Canonical: https://refer.sourcex.si/resources/false-positive-investigation-closure-referral-brief-template
Last updated: 2026-10-18

A company introduction about false-positive investigation closure should be one page of metadata the security operations lead can forward to the CEO without editing: company size, the closure task, record classes, systems, years covered, rough case volumes, how complete the joins are, the access deadline, what is client data, and who can decide. Nothing in it should be an alert, a case or a log line. The blank template comes first, then one completed Illustrative brief.

This template belongs to the [false-positive investigation closure guide](/guides/workflow-false-positive-investigation-closure). It does one job: make the introduction short, accurate and safe to forward.

## Blank template: fourteen lines

Fill in the right-hand column with the security operations lead. Keep each entry to a line or two.

| Line | What to write | Your entry |
|---|---|---|
| Company type and size | Provider or in-house security team; full-time employees at peak, contractors excluded | Write it in |
| Location and language | Country; share of case notes in English | Write it in |
| Closure task | The workflow in one sentence | Write it in |
| Record classes | Names only: alerts, cases, notes, verdicts, rule versions, tuning reviews, automation rules | List them |
| Systems | Detection platform, case manager, rule repository, automation tool, ticketing | List them |
| Years covered | First and last year per system, and any gap | Write them |
| Volumes | Rough closed-case counts, marked verified or unverified | Estimate |
| Join completeness | Do cases carry alert IDs and rule versions as fields? Yes, no or partly. | Answer |
| Verdict quality | Free-text reasoning, labels only, or mixed; any years at a default label | Answer |
| Exception example | One sentence, no client names | Write one |
| Access deadline | Date and event, such as read access to the old platform ending | Write it in |
| Ownership note | Which records are the company's own and which derive from client telemetry | Write it in |
| Authorized contact | Name of the CEO, who decides | Name them |
| Not shared | A statement that no record was shared | Confirm it |

## Notes on four lines that need care

- **Verdict quality.** Labels change with platforms and with team habits, and older closures often carry a default or blank label even when an analyst wrote a full explanation in the notes. Write what the security operations lead knows, including the years where labels are unreliable.
- **Volumes.** One case can be many rows. In Microsoft Sentinel's SecurityIncident table, each record carries a LastModifiedTime for the change it describes, so one case appears as many records and a row count overstates cases. Ask for case counts, not row counts.
- **Ownership note.** This is the line counsel reads first. Separate the provider's own notes, rules and reviews from client telemetry, and say plainly where the split is not yet known.
- **Not shared.** Detections carry user names, host names and IP addresses. Under the GDPR, personal data includes information identifying someone by an identification number or an online identifier, which is why nothing from a case belongs in the brief.

## A completed brief (Illustrative)

Illustrative. A fictional 240-person managed security provider. No real company or client is described.

| Line | Entry |
|---|---|
| Company type and size | Managed security provider, 240 full-time employees at peak |
| Location and language | Canada; case notes in English |
| Closure task | Triage and closure of alerts later judged benign or false, with rule tuning and follow-up checks |
| Record classes | Alerts, cases and analyst notes, verdicts with reasons, rule versions with review comments, automation rules |
| Systems | Current SIEM, case manager, Git repository for detections, ITSM for change tickets |
| Years covered | Cases 2020 to 2026; rule repository from 2021 |
| Volumes | About 60,000 closed cases, unverified |
| Join completeness | Alert IDs on cases since 2021; rule versions on alerts since 2022 |
| Verdict quality | Free-text reasoning throughout; labels mostly left at the default before 2022 |
| Exception example | A backup agent's mass file reads that looked like ransomware staging |
| Access deadline | Old SIEM read access ends at contract renewal next year |
| Ownership note | Provider's own notes, rules and reviews; client telemetry excluded pending counsel review |
| Authorized contact | CEO, with general counsel |
| Not shared | No alert, case, log or client name was shared |

Read top to bottom, the brief answers the CEO's four questions: what exists, how good it is, what might be lost, and who decides. The exception example points to the kind of case walked through in the [worked hard case](/guides/false-positive-investigation-closure-exception-examples).

## Before it leaves the security operations lead's desk

1. Every entry is a description, a yes or no, a count or a role.
2. No client is named or identifiable.
3. Unverified figures say so.
4. The authorized contact can actually decide; the [who-can-license decision tree](/questions/who-can-license-false-positive-investigation-closure-records) helps confirm it.
5. The company meets the basics: 50+ full-time employees at peak (contractors excluded), a documented operating history, rights to license the records, and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English.

What the brief cannot settle: rights, client consent, de-identification, dataset demand and any offer. Those stay unknown until SourceX reviews the opportunity with the company. The [warm introduction brief](/resources/a-warm-introduction-brief-for-a-business-owner) gives the covering note, the [cybersecurity services fit page](/industries/refer-cybersecurity-services-firm-data-licensing) explains which security records are usually in scope, and the [PII versus personal data comparison](/compare/pii-vs-personal-data) helps with the identifier question.

## Next step

> **Refer a company. Earn up to $100,000.** Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.

When the security operations lead has approved the completed brief and the decision-maker has agreed to be introduced, [register as a partner](/register), confirm the company on [who qualifies](/who-qualifies), and read the [program terms](/terms) before you send it.

## Sources

- https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityincident
- https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
- https://refer.sourcex.si/terms