Change Alert Status

Alerts can be in the following statuses:

  • Open - The default state when an alert is created.
  • In Progress - You can change an alert into this status to show that it is being managed.
  • Closed - An alert can be closed manually or by policy. When you close an alert manually, you select a reason, and you can add comments and rate the alert The in progress and closed statuses are displayed in the Alerts list. All of the statuses are displayed in the Alert description.

You can change from the current status to any other status.

In the default Alerts list filter, closed alerts are not displayed. To see closed alerts, change the Status filter to include closed alerts.

You can change the status of a single alert or of many alerts at one time.

To change the status of a single alert:

  1. From the Alerts list, select an alert.
  2. From the footer of the Alert description, click Close/Reopen the alert.
    For other options, click the down-arrow on that button.
  3. If you are closing an alert, select a reason.
  4. (Optional) You can rate the alert.
    The rating is sent to the Threat Command team for future improvements.

The alert status is changed.

To change the status of multiple alerts:

  1. From the Alerts list, select multiple alerts, as described in Perform Actions on Multiple Alerts.
  2. From the Bulk actions toolbar, click temporary placeholder and select the new status.
  3. If you are closing an alert, select a reason.
  4. (Optional) You can rate the alert.
    The rating is sent to the Threat Command team for future improvements.