Closing multiple incidents in the ATP/SEDR interface

Products

• Endpoint Detection and Response
• Advanced Threat Protection Platform

Issue/Introduction

There is a need to close multiple Incidents on the Advanced Threat Protection or Symantec Endpoint Detection and Response appliance with minimum manual effort.

Resolution

When viewing the Incidents, the Organism icon to the left of each Incident will turn into a + sign. Once an Incident is selected, you can select up to 500 more. After all desired Incidents are selected, click Close Incidents on the bottom right.

 

Now select the Resolution and provide any comments to be added when the Incidents are closed.