Event Management: Threshold Breach Alert Remains Open After Clear Event

[Tetsuya3]

Hello,

In Event Management, when an alert is generated due to a threshold breach, I notice that even if an event with Severity = Clear is received afterward, the alert is not closed.

Is this expected behavior?

Do I have to rely on the IDLE time setting in the event rule to close the alert, rather than having it closed by the Clear event update?

Thank you in advance for your guidance!

Best regards,

Tetsuya

[Pratiksha · Accepted solution]

• Yes, this is expected.

• Yes, by default you rely on IDLE time to close the alert.

• You can implement Clear-event–driven closure, but it’s not the out-of-the-box behavior.