Resolve an incident related to an alert

When you resolve an incident that is associated with an alert, the alert can also close according to the evt_mgmt.incident_closes_alert property.

Before you begin

Role required: evt_mgmt_admin, evt_mgmt_operator, or evt_mgmt_user

Procedure

1. Open an incident.
2. Click Resolve Incident.

   The corresponding alert is closed, resolved, or left alone as specified by the evt_mgmt.incident_closes_alert system property.

   The alert may not close immediately when the incident is closed. Depending on the value of the evt_mgmt.alert_rule_close_delay parameter, the alert may close 5 seconds after the last alert update. This value (in seconds) is defined in the parameter. To use the property, you need to create the property with the same name and assign the required value to it. For more information on how to create a property, see Add a system property.