Closed EDR incident gets recreated (Same event is showing up on the "CLOSED" incident and "NEW" Incident.)
book
Article ID: 192097
calendar_today
Updated On:
Products
Endpoint Detection and Response
Issue/Introduction
Closed incident gets recreated (Same event is showing up on the "CLOSED" incident and "NEW" Incident.)
Cause
The SEPM is reporting the same event over and over.
Resolution
Troubleshoot SEP Manager and/or SEP Client to identify why the same event occurs repeatedly.
Feedback
thumb_up
Yes
thumb_down
No