topic Automatically changing the status of incidents in Cortex XDR Discussions

Automatically changing the status of incidents

Aiman_Fathima — Thu, 03 Nov 2022 17:57:13 GMT

Hello,

Cortex XDR is changing the status of incidents from Resolved to Under Investigation automatically. Why is this happening?

Re: Automatically changing the status of incidents

neelrohit — Thu, 03 Nov 2022 19:02:01 GMT

Hi @Aiman_Fathima ,

Thank you for writing to live community!

It is possible that when the incidents are resolved the alerts were also marked as false positive and later someone changed the status one of the alerts attached to the incidents to "Under Investigation". As a result this opens the incident back again. Please check the management audit logs if there was an alert that was opened that was attached to this incidents.

Also it is possible that there were some new alerts moved to this resolved incident which could have caused it.

Hope this helps! Please mark the answer as "Accept as Solution" if it does.

Regards.

Re: Automatically changing the status of incidents

Aiman_Fathima — Thu, 03 Nov 2022 19:09:35 GMT

Thank you

Re: Automatically changing the status of incidents

AndreSilva — Fri, 04 Nov 2022 15:30:51 GMT

I would like to restart this topic, just to ask more details about changing incident status.

In one of incidents Cortex change the status of incident to "Resolved - Auto Resolve". I tried investigate what is the reason to this behavior and the alert associated was excluded. My question is how do I know what is the exclusion responsible for that?

Thanks!

Re: Automatically changing the status of incidents

nikoolayy1 — Mon, 07 Nov 2022 15:21:35 GMT

Nice !

Re: Automatically changing the status of incidents

j.velasquez765923 — Fri, 27 Feb 2026 20:29:44 GMT

Hey Andre, what did you find on this?
I found out that most of this happens with NGFW detection not XDR/XSIAM agent itself. Did you see anything different?