Status changes for alerts

The status of individual alerts in other sections of the console (for example, Protection > Threats,

CylanceOPTICS

> Detections, and Protection > Protect Mobile alerts) correspond to an equivalent status in the Alerts view. When an alert status changes in another view, the status is also updated in the Alerts view. For example, if the status of an alert in Detections changes to False Positive, the status in the Alerts view changes to Closed.

When you change the status of individual alerts in the Alerts view, an equivalent status change is displayed in the

CylanceOPTICS

> Detections view. Currently, status changes that you initiate in the Alerts view will not be displayed in the Protection > Threats view or in the Protection > Protect Mobile alerts view.

Note the following equivalent states for

CylancePROTECT Desktop

threat alerts:

Alerts displayed in Protection > Threats with an Unsafe, Abnormal, or Quarantined status have a New status in the Alerts view.
Alerts displayed in Protection > Threats with a Waived status have a Closed status in the Alerts view.

If you set a status for an alert group, the individual alerts in that group are assigned the status that you selected. If the individual alerts in an alert group have different statuses, either from manual status changes or as a result of status changes that come from another view (for example,

CylanceOPTICS

> Detections), the status of the alert group changes to Multiple. If all of the individual alerts in an alert group have the same status, the alert group will also have the same status. For example, if all of the individual alerts have a status of Closed, the status of the alert group is also Closed.