SCM Device Restart Incidents — False Positive Notification

[shpereira]

This is to inform you of a known issue affecting Firewall Restart Incidents in Strata Cloud Manager (SCM).

What happened

Beginning April 16, 2026, a subset of customers received a high volume of "Device Restarted" incidents for firewalls and Panorama instances that had not actually restarted. These were false positives caused by a defect introduced in a recent update to the SCM alert evaluation engine. Affected devices remained fully operational throughout this period.

Current Status

The Device Restarted incident has been temporarily disabled as of 10 AM April 22, 2026, Pacific time, while we implement and validate a complete fix. No new Device Restarted incidents will be generated during this time.

What You Should Do

• No action is required on your devices. All firewalls and Panorama instances are operating normally.
• If you have open support cases related to this incident, our team will follow up directly with resolution status.

Next Steps

• We will clear all false-positive incidents from your SCM dashboard by April 23rd. You will no longer see these incidents in your incident list.
• We will notify you when the incident is restored and accurate detection resumes.

Thank you for your patience.

[wsudman]

I got this message this morning and my NGFW did not reboot.  This appears to be reenabled and still sending false positives.

[amaynard]

Hi Wsudman,

We also received a flurry of alerts about delayed telemetry.