Automatically changing the status of incidents

[Aiman_Fathima]

Hello,

Cortex XDR is changing the status of incidents from Resolved to Under Investigation automatically. Why is this happening?

[neelrohit · Accepted solution]

Hi @Aiman_Fathima ,

Thank you for writing to live community!

It is possible that when the incidents are resolved the alerts were also marked as false positive and later someone changed the status one of the alerts attached to the incidents to "Under Investigation". As a result this opens the incident back again. Please check the management audit logs if there was an alert that was opened that was attached to this incidents. 

Also it is possible that there were some new alerts moved to this resolved incident which could have caused it.

Hope this helps! Please mark the answer as "Accept as Solution" if it does.

Regards. 

[Aiman_Fathima]

Thank you 

[AndreSilva]

I would like to restart this topic, just to ask more details about changing incident status.

In one of incidents Cortex change the status of incident to "Resolved - Auto Resolve". I tried investigate what is the reason to this behavior and the alert associated was excluded. My question is how do I know what is the exclusion responsible for that?

Thanks!

[nikoolayy1]

Nice !