05-15-2022 03:24 PM
I would like to determine how to view the identity of the user who resolved an incident in Cortex XDR. Presently the only artifact available is a "Resolved Timestamp". This however tells you WHEN an incident was resolved not WHO resolved it.
Is there anyway to view this information - WHO resolved an incident?
05-16-2022 06:24 AM
Hi @chukaokonkwo, the identity of the user that resolved the incident can be references in the Incident Timeline tab of the incident(s) in question. You may also consider to filter the Management Audit logs as well. The following is an example filter: Type = Incident Management AND Subtype Contains Change Incident Status AND Description Contains Resolved.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
