Verdict labels renamed: Benign and Suspicious

Released: 23 September 2026

No impact on your existing automations. The API keeps returning the same values as before (NOT_HARMFUL, INCONCLUSIVE, etc.) in investigation.report.outcome, so your SOAR playbooks, ServiceNow flows and other integrations keep working as they are. No action is needed on your side.

We have renamed two of the verdicts Qevlar assigns at the end of an investigation to make them clearer:

Only the labels have changed. The investigation logic and the way verdicts are decided stay exactly the same: an alert that would have been Not Harmful yesterday is Benign today.

What each verdict means

Malicious

We found evidence of an attack: a malicious indicator, or behavior matching a known attack technique, confirmed by at least one step of the investigation.

What to do: treat it as a real incident.

Suspicious

We found no evidence of an attack, but we could not explain everything either.

At least one element is left unaccounted for: the evidence neither shows a threat nor shows that the activity was ordinary. The report names which element it is.

What to do: review it, starting from the element flagged in the report.

Benign

The evidence accounts for what happened. There is no malicious indicator and no attack technique, and the activity fits what we would expect for this user, host or application.

What to do: no action needed.

Missing Data

We could not finish the investigation because the evidence we needed was not reachable: a source is not connected, we do not have permission to query it, or the data came back with nothing usable.

This is a gap in what we could see, not a judgement about the alert.

What to do: check the data source or the access. Fixing it usually turns this into a real verdict.

What changes in the platform

Investigation reports now display the new labels, Benign and Suspicious, in place of Not Harmful and Inconclusive.

What changes in the API

The investigation result endpoint returns a new top-level field, verdict, next to category and type:

GET /v2/investigations/{alert_id}/result

{
  "title": "Suspicious outbound connection to malicious IP",
  "source_severity": "HIGH",
  "category": "Endpoint",
  "verdict": "BENIGN",
  "description": "...",
  "type": "EDR Detection",
  "investigation": {
    "report": {
      "outcome": "NOT_HARMFUL"
    }
  }
}

• verdict (new): returns MALICIOUS, SUSPICIOUS, BENIGN or MISSING_DATA.
• investigation.report.outcome (unchanged): keeps returning MALICIOUS, NOT_HARMFUL, INCONCLUSIVE or MISSING_DATA, exactly as before.

Good to know: for now, verdict is available on the investigation result endpoint only. The investigation list endpoint still exposes the legacy outcome field. We will update this article when verdict is added there.

Do I need to do anything?

No. This change is additive and does not break anything. The legacy investigation.report.outcome field and its values are unchanged, so SOAR playbooks, ServiceNow flows and other integrations that rely on NOT_HARMFUL or INCONCLUSIVE keep working as they are.

We recommend using the new verdict field for new integrations, and moving existing ones to it whenever it suits you. We will give advance notice before any change to the legacy investigation.report.outcome field.

FAQ

Will I see more Suspicious alerts than I used to see Inconclusive alerts?

No. The decision logic has not changed, so the verdict distribution stays the same. Only the name is different.

Are past investigations affected?

Past investigations display the new labels too. Through the API, verdict is derived from the existing verdict, so it is available for past investigations as well.

How do I map the old values to the new ones in my automation?

NOT_HARMFUL → BENIGN, INCONCLUSIVE → SUSPICIOUS. MALICIOUS and MISSING_DATA are unchanged. The simplest option is to read the new verdict field directly.