When Kaspersky EDR Expert registers a new alert, the alert has the New status. You can change the status to In progress or Closed. When you change the New status to In progress, the alert is automatically assigned to you. When you change the New status to Closed, and the alert has no assignee, the alert is automatically assigned to you.
This status means that an analyst started working on the alert. When you set the In progress status, the alert is automatically assigned to you. You can change the In progress status to New or Closed.
True positive alerts are to be linked to incidents and be investigated within the incidents. When you close an incident, the linked alerts also gain the Closed status. You close an unlinked alert only as false positive or a low-priority alert. When you close an alert, you must select a resolution and provide a short comment.
The Closed status can only be changed to status New. If you want to return a closed alert back to active, change its status as follows: Closed→New→In progress.
When you close an alert linked to an incident, the alert is automatically unlinked from the incident. If the alert that you are going to close has no assignee, the alert is automatically assigned to the analyst who closes the alert.
Alerts gain this status when they are linked to an incident. You cannot set this status manually. You can only set the Closed status to a linked alert. To set the New or In progress status, you first must unlink the alert from the incident.
To change the status of one or several alerts:
In the main menu, go to MONITORING & REPORTING→Alerts.
If you have both Kaspersky EDR Optimum and Kaspersky EDR Expert integrated into Kaspersky Security Center Cloud Console, the Alerts section is divided into two tabs. Go to the Expert tab. Otherwise, skip this step.
Select the check boxes next to the alerts whose status you want to change.
Click the Change status button.
In the Change status window, select the status to set.
If you set the Closed status, you must select a resolution and provide a short comment.