Why Alerts are visible on Prisma Cloud when resources has been removed from the client's account?
542
Created On 06/22/23 08:51 AM - Last Modified 11/27/23 15:42 PM
Question
- Why customers see alerts in Prisma Cloud even after deleting resources from their Cloud account.
- Alert Overview with alerts for resources removed from customer cloud accounts:
- RQL ex_1:
- RQL ex_2:
Environment
- Prisma Cloud
- Alerts
Answer
- Audit event alerts are generated for the events that have already occurred, so they can never be resolved and have to be dismissed.
- One exception is descoping. Like if policy is disabled, alert rule is disabled or policy or account is removed from alert rule etc.
- To sum up, it is working as designed.
Additional Information
View our documentation here on alert status.