Resolving a Problem

• Console
• CLI
• API

• 1. Open the navigation menu and select Identity & Security. Under Cloud Guard, select Alerts.
  2. On the Alerts page, select Problems.

     You can also reach the Problems page by clicking through from summary information on the Overview page. See Getting Summary Information on the Overview Page.

     If you select through from summary information on the Overview page, the problems list is automatically filtered to show only the problems represented in the summary information.

  3. On the Problems page, select the name of the problem to open its details page.
     If needed, filter the list of problems to find the one that you want to resolve. For filtering information, see Listing Problems and Getting Their Details.
  4. View the details for the problem to determine how you want to resolve it.
     • View the Recommendation on the Details tab and implement it if appropriate.
     • select Remediate to view the responder rule that Cloud Guard recommends implementing.
       Note
       
       Not all problem types support the Remediate option
  5. To remediate the problem by implementing the recommended responder rule, follow these steps:
     1. select Remediate to open the Remediate panel.
     2. View the recommended rule listed in Remediation responder rule.
        You can select another rule if one is available.
     3. If policies are listed in a Required policy statements section, select Add statements.
     4. Select Post Remediation Notification to get event notification after the remediation occurs.
     5. select Remediate.
     6. Confirm that you want to execute the responder rule to remediate the problem.
  6. To indicate that the problem has been resolved, follow these steps:
     1. On the problem details page, select Mark as resolved.
     2. In the Mark as resolved dialog box, optionally add a comment indicating how the problem was resolved, and then select Mark as resolved.
        Although a comment isn't required, it's a best practice add one as an audit trail for future reference.

        Tip
        
        You can also mark one or more problems as resolved from the Problems page by selecting the check boxes next to the problems and selecting Mark as Resolved near the top of the page.

        You can select a maximum of 20 problems to process at one time through the UI. If you do the processing through the Cloud Guard and Security Zones API, you can process up to 50 problems at one time.

  7. To dismiss a problem, follow these steps:
     1. On the problem detail page, select Dismiss.
     2. In the Dismiss dialog box, optionally add a comment indicating how the problem was resolved, and then select Dismiss.
        Tip
        
        You can also dismiss one or more problems from the Problems page by selecting the check boxes next to the problems and selecting Dismiss near the top of the page.

        You can select a maximum of 20 problems to process at one time through the UI. If you do the processing through the Cloud Guard and Security Zones API, you can process up to 50 problems at one time.

  8. To reopen a dismissed problem, follow these steps:
     1. On the problem's detail page, select Reopen.
     2. In the Reopen dialog box, select Reopen.

• For a complete list of flags and variable options for CLI commands, see the Command Line Reference.

  Problems

  Use the oci cloud-guard problem trigger-responder command and required parameters to push a problem to a responder:

  Command

  CopyTry It

  oci cloud-guard problem trigger-responder --problem-id <problem_ocid> --responder-rule-id <responder_rule_id> [OPTIONS]

  Use the oci cloud-guard problem update-bulk-problem-status command and required parameters to perform a bulk status update on a list of problems:

  Command

  CopyTry It

  oci cloud-guard problem update-bulk-problem-status --problem-ids <problem_ocid_list> --status <action_taken> [OPTIONS]

  Use the oci cloud-guard problem update-problem-status command and required parameters to update the status of a single problem:

  Command

  CopyTry It

  oci cloud-guard problem update-problem-status --problem-id <problem_ocid> --status <action_taken> [OPTIONS]

  Responder Executions

  Use the oci cloud-guard responder-execution skip-bulk command and required parameters to skip execution for a list of responder executions:

  Command

  CopyTry It

  oci cloud-guard responder-execution skip-bulk --responder-execution-ids <responder_execution_id_list> [OPTIONS]

  Use the oci cloud-guard responder-execution skip command and required parameters to skip execution for a single responder execution:

  Command

  CopyTry It

  oci cloud-guard responder-execution c --compartment-id, -c <compartment_ocid> --responder-execution-id <responder_execution_identifier> [OPTIONS]

• For a complete list of parameters and values for CLI commands, see the CLI Command Reference.

  Problems

  Run the TriggerResponder operation to push a problem to a responder.

  Run the UpdateBulkProblemStatus operation to perform a bulk status update on a list of problems.

  Run the UpdateProblemStatus operation to update the status of a single problem.

  Responder Executions

  Run the SkipBulkResponderExecution operation to skip execution for a list of responder executions.

  Run the SkipResponderExecution operation to skip execution for a single responder execution.