Hi @Aiman_Fathima , It seems it is still not clear who the incident and alert process work in XDR. You do not resolve alerts, you resolve incidents. When you set the status of an incident "Resolved-xxx", you get the option to "resolve" the associated alerts. In the Alert table, you have the column " Resolution Status ". This column allows you to know if the alert was handled. The alerts will NOT disappeared. You can hide them by using filters, though. There are 2 ways to "resolve" alerts. One by resolving incidents, another by changing the resolution status directly on the alert. And remember that you need to work from the Incident view and not from the Alert table directly
... View more