topic Notification when alerts/Incident is resolved in Cortex XDR Discussions

Notification when alerts/Incident is resolved

Belhaj_a — Thu, 28 Mar 2024 12:15:14 GMT

Hi Community

I am trying to get notifications when alerts or incidents are resolved but it doesnt seem that there is a direct way to do so.
So is there a way to send a notification (Syslog or Email) when an alert or an incident is resolved?
Thanks in advance.

Re: Notification when alerts/Incident is resolved

jmazzeo — Thu, 28 Mar 2024 12:54:25 GMT

Hi @Belhaj_a, thanks for reaching us using the Live Community.

The Incidents and Alerts status changes are stored in the Management Audit Logs dataset, that you can visually access to it from Settings - Management Audit Logs

You can use the Notification Forwarding feature to send syslog or email messages when a Management Audit Log that you need to be notified occurs.

Check the linked article, and you can create a filter like this one on the screenshot to filter the Resolved alerts or incidents only:

After the Scope definition you can select an Email distribution list and/or syslog server.

If this post answers your question, please mark it as the solution.

Re: Notification when alerts/Incident is resolved

Belhaj_a — Wed, 12 Jun 2024 07:09:20 GMT

Worked like a charm, thanks alot