Strata Cloud Manager Alerts/incidents Management

[A.Taylor745130]

Hi,

I was hoping someone could assist me or point me to a article that I might've missed.

I'm working on SCM and struggling to close incidents. I can only suppress them, however, I can see that there are closed incidents in the history. I would like to make use of ServiceNow and want to have it close incidents/alerts.

[J.Taylor994192]

Is this for Prisma SD-WAN?

Also, I have to ask: are you resolving the underlining issue if you just close the incident? Unless I'm missing something, they should only close if the issue is resolved.

For Prisma SD-WAN, incidents and alerts only close based on system-defined parameters and thresholds, and the only actions available for incidents are dampening and escalation. 

Prisma Access seems to have options for clearing incidents but they give a prompt asking for feedback about why you're clearing the incident. 

I don't have access to NGFW features so I can't speak to those incidents/alerts*. 

[A.Taylor745130]

Hi,

Thank you and yes, those issues are cleared or a accepted risk process has been completed. I do understand best practice is just to suppress the event and wait till SCM closes it. I was just curious if there is a manual process to close a alert/incident.