Closed EDR incident gets recreated (Same event is showing up on the "CLOSED" incident and "NEW" Incident.)

Products

• Endpoint Detection and Response

Issue/Introduction

Closed incident gets recreated (Same event is showing up on the "CLOSED" incident and "NEW" Incident.) 

Cause

The SEPM is reporting the same event over and over.

Resolution

Troubleshoot SEP Manager and/or SEP Client to identify why the same event occurs repeatedly.