10-10-2023 07:19 AM
Hi Eric_Geater,
When you right-click on an alert and click Exclude Alert, you are performing a one-time action to exclude that single alert. It does not affect future alerts or any other existing alerts, nor does it create any rule in your Exceptions Configuration page. You can still find the alert within the incident (though, if you exclude the last open alert in an incident, the incident will be automatically closed and may be removed from your Incidents page, depending on your filter configuration).
The easiest way to undo this is by opening the incident (again, you may need to update your Incident page filters), open the Alerts and Insights tab, right-click on the alert and select Undo Alert Exclusion. If the incident is currently closed, it will automatically reopen the Incident as well.
