Mark as Legitimate

"Mark as Legitimate" records that the asset belongs to your organisation: you own and manage it, and detection flagged it as suspicious. For example, a domain your marketing team registered, or your official account on a new social network. The dialog asks you to confirm that the selected assets are owned and managed by your organisation. Never use it for an asset someone else owns, however harmless; see Choosing between Accept Risk, False Positive, and Legitimate.

• Status: becomes "Closed Without Action". The finding gets the "Marked as Legitimate" mark and leaves the watchlist.
• Score and severity: the finding stops counting toward the Digital Risk Score. Severity does not change.
• Default views: the finding leaves the default open view.
• Where: Lookalike Domain, Account Impersonation, Potential Employee Profile, Rogue Mobile App, and Unauthorized Job Posting findings, in their grids, on the Findings page, and on their detail pages. An Exposed Code Repository finding offers it on its detail page only.
• Who: every role in a grid; Admins and Analysts on a detail page.
• Undo: none. To reopen the finding, use "Update Status"; the mark stays.

From the "Lookalike Domains" grid or a lookalike domain's detail page, it also adds the domain to your monitored domains in Monitored Assets. From the "Impersonating Social Media Accounts" grid, or the detail page of an impersonating account or a potential employee profile, it adds the account to your official accounts in Monitored Assets. From the Findings page or "Triage & Watchlist", only the finding changes.

In Executive Protection, the dialog asks you to confirm that the account is owned and managed by the individual: the account belongs to your executive.

Example: detection flags a domain that your marketing team registered for a campaign. Mark it as legitimate with "Registered by Marketing for the spring campaign".

Where finding actions live, and what holds for every one of them: Finding Actions.