Forum Discussion
Identify all the alerts related to an entity and close it
Hi abon13,
as far as I know, only incidents can be bulk closed, but that does not automatically close the alerts.
How to close sentinel bulk incidents - Microsoft Community Hub
Please click Mark as Best Response & Like if my post helped you to solve your issue.
This will help others to find the correct solution easily. It also closes the item.If the post was useful in other ways, please consider giving it Like.
Kindest regards,
Leon Pavesic
(LinkedIn)
The solution provided helped in associating the alerts into one incident but not for bulk closure. When I close the incident I still see the associated alerts "open". Was hoping the alerts will be closed automatically when its incident gets closed. Isn't it how it is supposed to work ?
If not, can you tell me how to close the alerts in bulk.
Thanks!!
Hi abon13,
thanks for the additional info.
As far as I know, closing an incident does not automatically close the associated alerts.
This is because an alert can be associated with multiple incidents, and closing one incident might not mean that the issue the alert is indicating has been resolved.
Each alert must be closed individually to indicate that the issue it was alerting for has been addressed.
Please click Mark as Best Response & Like if my post helped you to solve your issue.
This will help others to find the correct solution easily. It also closes the item.
If the post was useful in other ways, please consider giving it Like.
Kindest regards,
Leon Pavesic
(LinkedIn)
Hi abon13,
as far as I know, only incidents can be bulk closed, but that does not automatically close the alerts.
How to close sentinel bulk incidents - Microsoft Community Hub
Please click Mark as Best Response & Like if my post helped you to solve your issue.
This will help others to find the correct solution easily. It also closes the item.If the post was useful in other ways, please consider giving it Like.
Kindest regards,
Leon Pavesic
(LinkedIn)