> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/alerts/alert-status.md).

# Alert Status

Alerts transition through four basic statuses: **New**, **In Progress**, **Resolved**, and **Reopened**. There are multiple versions of the Resolved status (which are also called resolution statuses) to enable you to track why an alert was resolved.

A resolution status can be either *terminal* or *reopenable*. Terminal resolution means the alert will not be reopened if Xpanse continues to observe the problem. The following resolution statuses are terminal:

* Resolved - Contested Asset
* Resolved - Risk Accepted
* Resolved - No Risk

Reopenable resolution means that Xpanse will reopen the alert and set the status to **Reopen** if the issue is observed again. The following resolution statuses are reopenable:

* Resolved - No Longer Observed
* Resolved - Remediated Automatically
* Resolved

The table below describes the alert statuses. Some of these statuses are assigned by Xpanse and some are assigned manually by a user. You can manually change the status of any alert to any other status except **Resolved - No Longer Observed** and **Resolved - Remediated Automatically**, which are assigned by Xpanse only.

In addition to these built-in alert statuses, you can create custom alert statuses that are tailored to your workflow. For more information, see [Add Custom Alert and Incident Statuses and Resolution Reasons](/cortex-xpanse/incidents-and-alerts/incidents/incident-status.md#UUID-9f3a674b-4087-4ab1-0583-f6e4d8a134f2).

<table data-header-hidden><thead><tr><th width="152"></th><th width="257.5"></th><th></th></tr></thead><tbody><tr><td>Alert Status</td><td>Description</td><td>Set by User or System or Both</td></tr><tr><td><strong>New</strong></td><td><p>Indicates one of the following:</p><ul><li>Xpanse created a new alert because a risk was observed on your attack surface</li><li>A user manually set the status to <strong>New</strong></li></ul></td><td>Both. Xpanse sets the status to New when it opens an alert. A user can set the status to New anytime.</td></tr><tr><td><strong>In Progress</strong></td><td>Indicates that you have started investigating or remediating the alert.</td><td>User only</td></tr><tr><td><strong>Reopened</strong></td><td><p>Indicates one of the following:</p><ul><li>Xpanse reopened a formerly resolved alert</li><li>A user set the status to <strong>Reopened</strong>.</li></ul></td><td>Both</td></tr><tr><td><strong>Resolved - Contested Asset</strong></td><td><p>Indicates that you do not believe that this asset belongs to your organization.</p><p>This is a terminal resolution status.</p></td><td>User only</td></tr><tr><td><strong>Resolved - Risk Accepted</strong></td><td><p>Indicates that you understand that this alert poses a risk to your organization, but that you would like to accept the risk rather than address it.</p><p>This is a terminal resolution status.</p></td><td>User only</td></tr><tr><td><strong>Resolved - No Risk</strong></td><td><p>Indicates that you acknowledge that an alert exists, but that there is a mitigating control or other circumstances which results in the alert not being necessary.</p><p>This is a terminal resolution status.</p></td><td>User only</td></tr><tr><td><strong>Resolved - No Longer Observed</strong></td><td><p>Indicates that Xpanse no longer detects the issue on the service, asset, or website.</p><p>This is a reopenable resolution status.</p></td><td>System only</td></tr><tr><td><strong>Resolved - Remediated Automatically</strong></td><td><p>Indicates that automated remediation was used to remediate the alert.</p><p>This is a reopenable resolution status.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>This status is only used if you have the Active Response add-on module. See <a href="/pages/op3BiHtYzLUEscIQi4JO">Active Response</a> for more information.</p></div></td><td>System only</td></tr><tr><td><strong>Resolved</strong></td><td><p>Indicates that the alert was remediated.</p><p>This is a reopenable resolution status.</p></td><td>User only</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/alerts/alert-status.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.