Alert Status | Zscaler

Posture Control (ZPC)

Alert Status

Alerts that are initially triggered are in Open status. When these alerts are evaluated and addressed, the status transitions to resolved or closed.

ZPC alerts can have any of the following statuses:

Alert Status	Description	Example Scenario for Cloud Alerts	Example Scenario for IaC Alerts
Open	The new alerts triggered for policy violations.	An alert is triggered when encryption on the Amazon S3 bucket is missing. The status of this alert is set to Open and the alert details are displayed on the Alerts page. To learn more, see About Alerts.	An alert is triggered when the IaC Scan app detects a misconfiguration in the code leading to a IaC security policy violation.
Closed	Alerts that are no longer valid.	The cloud account is deleted or offboarded. The policy that the alert was triggered for is deleted. The predefined policy is deprecated as it is not relevant. The custom policy query is edited. The custom policy is deleted. The cloud resource is deleted.	When the IaC Scan app or an IaC integration is deleted. When the IaC subscription is expired or removed. When the repository is permanently deleted or the repository is unsubscribed and is no longer being monitored by ZPC. When the resource or branch is deleted.
Resolved	The issue (for which an alert was generated) is resolved.	An alert is triggered because the encryption is disabled on an Amazon S3 bucket. You can enable the encryption on the Amazon S3 bucket and change the alert status to Resolved in the ZPC Admin Portal.	When the developer fixes the misconfiguration in the IaC code.
Reopened	ZPC automatically grants this status to an existing alert that was previously resolved. You can only reopen resolved alerts, but cannot reopen closed alerts.		When a misconfiguration is detected again in the IaC template.

Was this article helpful? Click an icon below to submit feedback.