> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/resolve-incidents-with-active-response.md). # Resolve Incidents with Active Response Use Active Response to automate the investigation and resolution of alerts and incidents in Expander. The following procedure describes how to resolve incidents using Cortex Xpanse Active Response. To resolve an incident, you will resolve each of the alerts associated with that incident. Before you begin using Active Response, complete the following prerequisites: * [Set Up Active Response](/cortex-xpanse/active-response/set-up-active-response.md) by configuring remediation path rules and automation integrations. * Review [Incidents](/cortex-xpanse/incidents-and-alerts/incidents.md) to familiarize yourself with the Incidents page layout and information. * Review the [Automated Remediation Capabilities Matrix](/cortex-xpanse/active-response/automated-remediation-capabilities-matrix.md) to learn about Active Response automated remediation options and requirements. ## Resolve Alerts 1. Navigate to **Incident Response** → **Incidents** and review the list of incidents. By default incidents are sorted by risk, but you can sort and filter incidents based on your requirements. 2. Select your highest-priority incident with alerts that indicate **Needs Input**. 3. In the incident details pane on the right, review the alerts to understand the risk and the context that has been gathered through the playbook execution so far. The **Overview** tab in the right pane provides the **Alert Description**, **Alert Status**, and **Playbook Status** for each alert related to the incident. The **Alerts** tab provides additional details about each alert, including detection details and remediation guidance. 4. In the **Overview** tab, click **+Provide Input** and follow the prompts to select a remediation or notification option. Depending on the type of alert and your configured integrations, remediation options may include the following: * **Manual remediation** * **Automated remediation** * **Send a notification email** * **File a ticket** Consult the [Automated Remediation Capabilities Matrix](/cortex-xpanse/active-response/automated-remediation-capabilities-matrix.md) to learn about automated remediation options and requirements. Once you've selected the remediation option, the playbook changes the alert status to **In Progress**.

Note

If you have a remediation path rule that matches the alert criteria, you will not be prompted to select a remediation option. Instead, the playbook will use the remediation option defined in the rule.

5. If a matching remediation path rule specified automated remediation, or if you chose **Automated Remediation** in step 4, Active Response will automatically fix the issue that triggered the alert. If you specified Manual Remediation, Send a notification email, or File a ticket, either manually or through a remediation path rule, the playbook will display a new **Needs Input** prompt asking you to confirm that the alert has been remediated. When appropriate, click **+Provide Input** and confirm the remediation. Once the alert has been remediated manually or by automatically by Active Response, the playbook verifies that the service is no longer observable by performing a remediation confirmation scan and then changes the alert status to **Resolved**. 6. Repeat steps 4 and 5 for each alert in the incident. After all the alerts for the incident have been resolved, the playbook automatically marks the incident as **Resolved**. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/resolve-incidents-with-active-response.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.