After enrolling your SEDR appliance to the cloud, Incidents before that will retain the old SEDR appliance name

Products

• Endpoint Detection and Response Cloud
• Endpoint Detection and Response

Issue/Introduction

When you integrate the SEDR appliance with the cloud portal, all newly created Task Incidents have the new appliance name provided during the cloud registration. If you remove that appliance and re-add it with a different name, old Incidents are not retroactively updated.

Resolution

Old Tasks (Incidents) will retain the old SEDR appliance name and will take on the new appliance's name if the Task (Incident) gets updated by a new event, new comment, or any change to the Read status.

The Event and Incident Forwarding feature does not upload events and Incidents created prior to the integration.