> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/alerts/prisma-cloud-alert-status-reasons.md). # Prisma Cloud Alert Status Reasons Review the different reasons on why an alert is in the **Open** or **Resolved** status on Prisma Cloud. When an open alert is resolved, the reason is included to help with audits. The reason is displayed in the response object in the API and on the Prisma Cloud administrative console on **Alerts > Overview** when you select a resolved alert and review the alert details for the violating resource. Some common reasons listed in the below table are also applicable for when an alert is newly opened or re-opened from the resolved status. | **Reason** | **Details** | | ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ACCOUNT\_DELETED | Account was deleted. When a cloud account that was being monitored on Prisma Cloud is deleted, all alerts are resolved with the resolution reason **Account Deleted** and the alerts are permanently deleted if the account is not added back within 24 hours. This status is sent with the alert payload to external integrations that you have configured. | | ACCOUNT\_GROUP\_UPDATED | Account group was updated. | | ACCOUNT\_GROUP\_DELETED | Account group was deleted. | | ALERT\_RULE\_DISABLED | Alert rule was disabled. | | ALERT\_RULE\_UPDATED | Alert rule was updated. The list of policies included in the rule, account groups being scanned, or cloud regions may have been modified. | | ALERT\_RULE\_DELETED | Alert rule was deleted. | | ANOMALY\_CONFIG\_CHANGED | Anomaly policy configuration changed. | | MDC\_REOPEN\_FOR\_ACCIDENTAL\_DELETE | Alert was reopened during ingestion beacuse a resource was rediscovered. | | NEW\_ALERT | A new alert was generated. | | POLICY\_UPDATED | Policy was updated. If an alert is resolved, this reason indicates a change in the policy RQL that results in a resource not being in scope for the policy evaluation. If the alert is in open status, this reason indicates that a policy update resulted in a resource being in the scope of the policy evaluation and failed the evaluation. | | POLICY\_DISABLED | Policy was disabled. | | POLICY\_DELETED | Policy was deleted. | | REMEDIATED | Alert was successfully remediated using the Cloud Service Provider CLI, either manually or by auto-remediation. | | RESOURCE\_DELETED | Resource was deleted. | | RESOURCE\_UPDATED | Resource was updated (based on the JSON metadata). This status indicates that a change was detected in one of the clauses included in a single or join policy statement within the policy RQL. If the alert is now in the resolved status, this reason indicates that the policy violation is no longer valid due to an update to the underlying resource. If the alert is in the open status, this reason indicates that the policy violation is now valid due to an update to the underlying resource. | | RESOURCE\_POLICY\_RESCOPED | Alert was resolved because the policy was updated and the violating resource is no longer scanned or within the scope of the modified policy. | | SNOOZED\_AUTO\_REOPEN | Snooze time expired for the alert and it was automatically reopened. | | USER\_DISMISSED | Alert was dismissed or snoozed by a Prisma Cloud administrator or by a user with the role of System Admin, Account Group Admin, or Account and Cloud Provisioning Admin. | | USER\_REOPENED | A dismissed or snoozed alert was reopened by a Prisma Cloud administrator or by a user with the role of System Admin, Account Group Admin, or Account and Cloud Provisioning Admin. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/alerts/prisma-cloud-alert-status-reasons.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.