> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/resolve-incidents-with-active-response.md). # Resolve Incidents with Active Response The following procedure describes how to resolve incidents using Cortex Xpanse Active Response. To resolve an incident, you will resolve each of the alerts associated with that incident. Before you begin using Active Response, complete the following prerequisites: * [Set Up Active Response](/cortex-xpanse/active-response/set-up-active-response.md) by configuring remediation path rules and automation integrations. * Review [Incidents](/cortex-xpanse/incidents-and-alerts/incidents.md) to familiarize yourself with the Incidents page layout and information. * Review the [Automated Remediation Capabilities Matrix](/cortex-xpanse/active-response/automated-remediation-capabilities-matrix.md) to learn about Active Response automated remediation options and requirements. ## Resolve Alerts 1. Navigate to **Incident Response** → **Incidents** and review the list of incidents. By default incidents are sorted by risk, but you can sort and filter incidents based on your requirements. 2. Select your highest-priority incident with alerts that indicate **Needs Input**. 3. In the incident details pane on the right, review the alerts to understand the risk and the context that has been gathered through the playbook execution so far. The **Overview** tab in the right pane provides the **Alert Description**, **Alert Status**, and **Playbook Status** for each alert related to the incident. The **Alerts** tab provides additional details about each alert, including detection details and remediation guidance. 4. In the **Overview** tab, click **+Provide Input** and follow the prompts to select a remediation or notification option. Depending on the type of alert and your configured integrations, remediation options may include the following: * **Manual remediation** * **Automated remediation** * **Send a notification email** * **File a ticket** Consult the [Automated Remediation Capabilities Matrix](/cortex-xpanse/active-response/automated-remediation-capabilities-matrix.md) to learn about automated remediation options and requirements. Once you've selected the remediation option, the playbook changes the alert status to **In Progress**.

Note

If you have a remediation path rule that matches the alert criteria, you will not be prompted to select a remediation option. Instead, the playbook will use the remediation option defined in the rule.

5. If a matching remediation path rule specified automated remediation, or if you chose **Automated Remediation** in step 4, Active Response will automatically fix the issue that triggered the alert. If you specified Manual Remediation, Send a notification email, or File a ticket, either manually or through a remediation path rule, the playbook will display a new **Needs Input** prompt asking you to confirm that the alert has been remediated. When appropriate, click **+Provide Input** and confirm the remediation. Once the alert has been remediated manually or by automatically by Active Response, the playbook verifies that the service is no longer observable by performing a remediation confirmation scan and then changes the alert status to **Resolved**. 6. Repeat steps 4 and 5 for each alert in the incident. After all the alerts for the incident have been resolved, the playbook automatically marks the incident as **Resolved**. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/resolve-incidents-with-active-response.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.