topic Re: Determining WHO Resolved An Incident In Cortex XDR in Cortex XDR Discussions

Determining WHO Resolved An Incident In Cortex XDR

chukaokonkwo — Sun, 15 May 2022 22:24:14 GMT

I would like to determine how to view the identity of the user who resolved an incident in Cortex XDR. Presently the only artifact available is a "Resolved Timestamp". This however tells you WHEN an incident was resolved not WHO resolved it.

Is there anyway to view this information - WHO resolved an incident?

Re: Determining WHO Resolved An Incident In Cortex XDR

WSeldenIII — Mon, 16 May 2022 13:24:57 GMT

Hi @chukaokonkwo, the identity of the user that resolved the incident can be references in the Incident Timeline tab of the incident(s) in question. You may also consider to filter the Management Audit logs as well. The following is an example filter: Type = Incident Management AND Subtype Contains Change Incident Status AND Description Contains Resolved.