topic Re: Closure of Bulk Alerts in Cortex XDR Discussions

Closure of Bulk Alerts

Aiman_Fathima — Tue, 21 Jun 2022 16:01:25 GMT

Hello,

Can anyone please suggest on how we can close bulk alerts on XDR. Currently we can only select 100 at a time.

Re: Closure of Bulk Alerts

fmoixsante — Tue, 21 Jun 2022 16:24:13 GMT

Even though, you have the possibility to resolve alerts from the Alert table, you need to work on the Incidents and close those.

If you are looking at the Alert Table, right-click on an Alert and go to Pivots to views > View related incidents.
You can also add the column Incident ID to the Alert table.

But remember that you need to work from the Incident view and not from the Alert table directly.

Re: Closure of Bulk Alerts

Aiman_Fathima — Tue, 21 Jun 2022 16:34:27 GMT

Thank you for your suggestion. We tried the above but still they do not get resolved sometimes so was wondering if there are any other methods

Re: Closure of Bulk Alerts

SilviuMihailDascalu — Tue, 21 Jun 2022 16:35:54 GMT

Hi Aiman,

Can you share a snapshot of the issue you're experiencing?

Thanks,

Silviu

Re: Closure of Bulk Alerts

Aiman_Fathima — Wed, 22 Jun 2022 08:51:16 GMT

Sorry cannot share the screenshot. The issue is that we have closed the incidents with 'resolve alerts option' but still the alerts are open.

Re: Closure of Bulk Alerts

fmoixsante — Wed, 22 Jun 2022 09:14:58 GMT

Hi @Aiman_Fathima ,

It seems it is still not clear who the incident and alert process work in XDR. You do not resolve alerts, you resolve incidents. When you set the status of an incident "Resolved-xxx", you get the option to "resolve" the associated alerts. In the Alert table, you have the column "Resolution Status". This column allows you to know if the alert was handled. The alerts will NOT disappeared. You can hide them by using filters, though.

There are 2 ways to "resolve" alerts. One by resolving incidents, another by changing the resolution status directly on the alert.

And remember that you need to work from the Incident view and not from the Alert table directly

Re: Closure of Bulk Alerts

Aiman_Fathima — Wed, 22 Jun 2022 12:33:00 GMT

We had resolved the incidents and used the option to close the associated alerts, but still in the alerts table we see the alerts resolution status as "NEW".

We currently have 2.8M alerts which are associated with already closed incidents and yet thier resolution status is still "NEW".

Re: Closure of Bulk Alerts

Jaitapkar — Fri, 24 Jun 2022 10:08:08 GMT

Hey @Aiman_Fathima ,

You can suppress the Alerts by using Alert Exclusions. By suppressing the alerts will auto resolved the incidents respectively.

Regards,

Mansoor