Closed EDR incident gets recreated (Same event is showing up on the "CLOSED" incident and "NEW" Incident.)

book

Article ID: 192097

calendar_today

Updated On:

Products

Endpoint Detection and Response

Issue/Introduction

Closed incident gets recreated (Same event is showing up on the "CLOSED" incident and "NEW" Incident.) 

Cause

The SEPM is reporting the same event over and over.

Resolution

Troubleshoot SEP Manager and/or SEP Client to identify why the same event occurs repeatedly.