Which Cisco AMP file disposition valid?

'Pristine' is not a standard, codified file disposition used by Cisco AMP.

'Malware' is a valid and commonly used file disposition in Cisco AMP, indicating that a file has been identified as malicious by AMP's analysis engines. Other common dispositions include Clean, Unknown, and Potentially Unwanted Application (PUA).

'Dirty' is not a standard, codified file disposition used by Cisco AMP.

'Nonmalicious' is a descriptive term, but 'Clean' is the specific, codified disposition used by Cisco AMP for files determined to be not malicious.