> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/alerts/alert-status.md).

# Alert Status

Learn about the alert lifecycle and definition of each alert status.

Alerts transition through four basic statuses: **New**, **In Progress**, **Resolved**, and **Reopened**. There are multiple versions of the Resolved status (which are also called resolution statuses) to enable you to track why an alert was resolved.

A resolution status can be either *terminal* or *reopenable*. Terminal resolution means the alert will not be reopened if Xpanse continues to observe the problem. The following resolution statuses are terminal:

* Resolved - Contested Asset
* Resolved - Risk Accepted
* Resolved - No Risk

Reopenable resolution means that Xpanse will reopen the alert and set the status to **Reopen** if the issue is observed again. The following resolution statuses are reopenable:

* Resolved - No Longer Observed
* Resolved - Remediated Automatically
* Resolved

The table below describes the alert statuses. Some of these statuses are assigned by Xpanse and some are assigned manually by a user. You can manually change the status of any alert to any other status except **Resolved - No Longer Observed** and **Resolved - Remediated Automatically**, which are assigned by Xpanse only.

In addition to these built-in alert statuses, you can create custom alert statuses that are tailored to your workflow. For more information, see [Add Custom Alert and Incident Statuses and Resolution Reasons](/cortex-xpanse/incidents-and-alerts/incidents/incident-status.md#UUID-9f3a674b-4087-4ab1-0583-f6e4d8a134f2).

<table data-header-hidden><thead><tr><th width="152"></th><th width="257.5"></th><th></th></tr></thead><tbody><tr><td>Alert Status</td><td>Description</td><td>Set by User or System or Both</td></tr><tr><td><strong>New</strong></td><td><p>Indicates one of the following:</p><ul><li>Xpanse created a new alert because a risk was observed on your attack surface</li><li>A user manually set the status to <strong>New</strong></li></ul></td><td>Both. Xpanse sets the status to New when it opens an alert. A user can set the status to New anytime.</td></tr><tr><td><strong>In Progress</strong></td><td>Indicates that you have started investigating or remediating the alert.</td><td>User only</td></tr><tr><td><strong>Reopened</strong></td><td><p>Indicates one of the following:</p><ul><li>Xpanse reopened a formerly resolved alert</li><li>A user set the status to <strong>Reopened</strong>.</li></ul></td><td>Both</td></tr><tr><td><strong>Resolved - Contested Asset</strong></td><td><p>Indicates that you do not believe that this asset belongs to your organization.</p><p>This is a terminal resolution status.</p></td><td>User only</td></tr><tr><td><strong>Resolved - Risk Accepted</strong></td><td><p>Indicates that you understand that this alert poses a risk to your organization, but that you would like to accept the risk rather than address it.</p><p>This is a terminal resolution status.</p></td><td>User only</td></tr><tr><td><strong>Resolved - No Risk</strong></td><td><p>Indicates that you acknowledge that an alert exists, but that there is a mitigating control or other circumstances which results in the alert not being necessary.</p><p>This is a terminal resolution status.</p></td><td>User only</td></tr><tr><td><strong>Resolved - No Longer Observed</strong></td><td><p>Indicates that Xpanse no longer detects the issue on the service, asset, or website.</p><p>This is a reopenable resolution status.</p></td><td>System only</td></tr><tr><td><strong>Resolved - Remediated Automatically</strong></td><td><p>Indicates that automated remediation was used to remediate the alert.</p><p>This is a reopenable resolution status.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>This status is only used if you have the Active Response add-on module. See <a href="/cortex-xpanse/active-response.md">Active Response</a> for more information.</p></div></td><td>System only</td></tr><tr><td><strong>Resolved</strong></td><td><p>Indicates that the alert was remediated.</p><p>This is a reopenable resolution status.</p></td><td>User only</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/alerts/alert-status.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.