Close Alerts using Splunk SIEM

The Close Alerts Alert Action closes the specified alert in Carbon Black Cloud.

Note:

• In Splunk SIEM 2.0.0, this action was renamed from Dismiss Alert to Close Alerts.
• See also Editing the Alert Workflow.

Configuration:

Alert ID Field

The field name in the search results that contains the Alert ID to close.