Prisma Cloud Audit Event Alerts remain in Open State despite change in the Policy RQL

• An Audit Event Policy RQL is modified.
• The modified RQL of this Policy in Investigate tab does not give the same resources as observed in Alerts Overview.
• As per Prisma Cloud Alert Resolution Reasons, an update in the Policy RQL will be one of the reasons behind an Open Alert to Close.
• However, Prisma Cloud Audit Event Alerts remain in Open State despite change in the Policy RQL.

• Prisma Cloud

• Audit Event Alerts are generated for the Events that have already occurred.
• Hence, these Open Alerts will never be resolved.
• This is expected behaviour as per product design.

• Dismiss the Open Alerts manually.

• Any Policy changes (eg. RQL modified) will be applicable only for New Events.
• No New Alerts should be generated for the Events that no more violate the Policy.

Additional References

• Prisma Cloud Alert Resolution Reasons