In SOI 4.2 there is a new column added to the alerts table "ClearedBy" , this column contains the who/what cleared the alert select * from Alerts where MDRAlarmID='Source Alert ID of the UIM alert" In this case there was an escalation action that was clearing the alert after 10 minute.