topic Re: SCM Device Restart Incidents — False Positive Notification in Strata Cloud Manager https://live.paloaltonetworks.com/t5/strata-cloud-manager/scm-device-restart-incidents-false-positive-notification/m-p/1253028#M129 <P>I got this message this morning and my NGFW did not reboot.&nbsp; This appears to be reenabled and still sending false positives.</P> Fri, 24 Apr 2026 19:56:40 GMT wsudman 2026-04-24T19:56:40Z SCM Device Restart Incidents — False Positive Notification https://live.paloaltonetworks.com/t5/strata-cloud-manager/scm-device-restart-incidents-false-positive-notification/m-p/1252826#M128 <P><SPAN>This is to inform you of a known issue affecting Firewall Restart Incidents in Strata Cloud Manager (SCM).</SPAN></P> <H2><SPAN><BR />What happened</SPAN></H2> <P><SPAN>Beginning April 16, 2026, a subset of customers received a high volume of "Device Restarted" incidents for firewalls and Panorama instances that had not actually restarted. These were false positives caused by a defect introduced in a recent update to the SCM alert evaluation engine. Affected devices remained fully operational throughout this period.</SPAN></P> <H2><SPAN><BR />Current Status</SPAN></H2> <P><SPAN>The Device Restarted incident has been temporarily disabled as of 10 AM April 22, 2026, Pacific time, while we implement and validate a complete fix. No new Device Restarted incidents will be generated during this time.</SPAN></P> <H2><SPAN><BR />What You Should Do</SPAN></H2> <UL> <LI style="font-weight: 400;" aria-level="1"><SPAN>No action is required on your devices. All firewalls and Panorama instances are operating normally.</SPAN></LI> <LI style="font-weight: 400;" aria-level="1"><SPAN>If you have open support cases related to this incident, our team will follow up directly with resolution status.</SPAN></LI> </UL> <H2><SPAN><BR />Next Steps</SPAN></H2> <UL> <LI style="font-weight: 400;" aria-level="1"><SPAN>We will clear all false-positive incidents from your SCM dashboard by April 23rd. You will no longer see these incidents in your incident list.</SPAN></LI> <LI style="font-weight: 400;" aria-level="1"><SPAN>We will notify you when the incident is restored and accurate detection resumes.</SPAN></LI> </UL> <P>&nbsp;</P> <P><SPAN>Thank you for your patience.</SPAN></P> Thu, 23 Apr 2026 03:44:41 GMT https://live.paloaltonetworks.com/t5/strata-cloud-manager/scm-device-restart-incidents-false-positive-notification/m-p/1252826#M128 shpereira 2026-04-23T03:44:41Z Re: SCM Device Restart Incidents — False Positive Notification https://live.paloaltonetworks.com/t5/strata-cloud-manager/scm-device-restart-incidents-false-positive-notification/m-p/1253028#M129 <P>I got this message this morning and my NGFW did not reboot.&nbsp; This appears to be reenabled and still sending false positives.</P> Fri, 24 Apr 2026 19:56:40 GMT https://live.paloaltonetworks.com/t5/strata-cloud-manager/scm-device-restart-incidents-false-positive-notification/m-p/1253028#M129 wsudman 2026-04-24T19:56:40Z Re: SCM Device Restart Incidents — False Positive Notification https://live.paloaltonetworks.com/t5/strata-cloud-manager/scm-device-restart-incidents-false-positive-notification/m-p/1253240#M131 <P>Hi Wsudman,</P> <P>&nbsp;</P> <P>We also received a flurry of alerts about delayed telemetry.&nbsp;</P> Tue, 28 Apr 2026 15:09:13 GMT https://live.paloaltonetworks.com/t5/strata-cloud-manager/scm-device-restart-incidents-false-positive-notification/m-p/1253240#M131 amaynard 2026-04-28T15:09:13Z