diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json
index 61d197f2db29..32080a2a1f44 100644
--- a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json
@@ -5944,7 +5944,7 @@
         "classification": {
           "description": "The reason the incident was closed",
           "enum": [
-            "Unknown",
+            "Undetermined",
             "TruePositive",
             "FalsePositive"
           ],
@@ -5954,8 +5954,8 @@
             "name": "IncidentClassification",
             "values": [
               {
-                "description": "Incident classification was not set",
-                "value": "Unknown"
+                "description": "Incident classification was undetermined",
+                "value": "Undetermined"
               },
               {
                 "description": "Incident was true positive",