Forum Discussion

abon13's avatar
abon13
Brass Contributor
Jan 10, 2024
Solved

Identify all the alerts related to an entity and close it

Hi,   I know we can identify and close alerts from Sentinel Incidents page, however clicking on every alert to find what Entities are those alerts associated and then selecting "close" is tedious. ...
investigation
siem
soar
  • LeonPavesic's avatar
    LeonPavesic
    Jan 12, 2024

    Hi abon13,

    as far as I know, only incidents can be bulk closed, but that does not automatically close the alerts.

    How to close sentinel bulk incidents - Microsoft Community Hub


    Please click Mark as Best Response & Like if my post helped you to solve your issue.
    This will help others to find the correct solution easily. It also closes the item.


    If the post was useful in other ways, please consider giving it Like.


    Kindest regards,


    Leon Pavesic
    (LinkedIn)

abon13's avatar
abon13
Brass Contributor
Jan 12, 2024

LeonPavesic 

 

In that case, do you think we can close such bulk alerts using the API or Logic Apps ? 

LeonPavesic's avatar
LeonPavesic
Silver Contributor
Jan 12, 2024

Hi abon13,

as far as I know, only incidents can be bulk closed, but that does not automatically close the alerts.

How to close sentinel bulk incidents - Microsoft Community Hub


Please click Mark as Best Response & Like if my post helped you to solve your issue.
This will help others to find the correct solution easily. It also closes the item.


If the post was useful in other ways, please consider giving it Like.


Kindest regards,


Leon Pavesic
(LinkedIn)