Kaspersky Next XDR Expert

Merging incidents

Two or more incidents may be interpreted as indicators of the same issue in an organization's IT infrastructure. If this is the case, you can merge the incidents to investigate them as a single issue.

When you merge incidents, you need to select a target incident among them. After the incident consolidation, the issue is to be investigated within the target incident. The target incident must have a status other than Closed. Other incidents are merged into the target one and, after consolidation, gain the Closed status and the Merged resolution.

All of the alerts linked to the merged incidents are automatically linked to the target incident. Because an incident can have no more than 1000 linked alerts, the application counts the alerts linked to the incidents that you want to merge. If the total number of linked alerts exceeds 1000, the selected incidents cannot be merged. When you select the target incident, a total number of alerts after merging is displayed.

You cannot merge child incidents or incidents that have child incidents.

To merge incidents from the incident table:

1. In the main menu, go to Monitoring & reporting → Incidents.
2. Select the check boxes next to the incidents that you want to merge into a target incident. You will select the target incident on the first step of the Wizard.
3. Click the Merge into incident button.
4. The Merge incidents Wizard opens.
5. Select the target incident.
6. Click the Merge button.

The incidents are merged.

To merge incidents by using incident details:

1. In the main menu, go to Monitoring & reporting → Incidents.
2. Click an incident ID to open the incident details. This incident will be merged into a target incident. You will select the target incident on the first step of the Wizard.
3. Click the Merge into incident button.

   The Merge incidents Wizard opens.

4. Select the target incident.
5. Click the Merge button.

The incidents are merged.