What's the difference between Resolving and Dismissing an ARO?

Introduction

NOTE: To re-open an ARO that was mistakenly Resolved or Dismissed, you must contact support.

Once you have addressed the root issues that generated a given ARO, it should be closed.

Closing an ARO

When Closing an ARO, you will be presented with different options that either resolve the ARO or dismiss it. Each ARO type will have different close options, and they will impact the way Field Effect MDR generates the same ARO in the future.

Resolve

Use the Resolve option to indicate that you have taken action that addressed the issue, and you want to be alerted again in the future should the exact same circumstance reoccur.

Dismiss

The Dismiss option acknowledges that you no longer want to receive AROs for this type of issue. Depending on the ARO, this may mean that you are not alerted again in the current calendar month, or never again for that particular user, or for any user. The options and their impacts are shown when closing the ARO (shown above), and unique to each ARO type.

Dismissed monthly AROs will be rechecked on the 1st of the new calendar and a new ARO will be created with updated actions for you to take.

Suppressing AROs with Data Tables

Some AROs, such as vulnerable software and/or operating systems, include Supplemental Data Tables that report all devices currently impacted by out-of-date software.

If you would prefer to work with these issues exclusively through data tables and not receive any AROs relating to software maintenance, they can be suppressed.

To learn more about ARO suppression and Supplemental Data Tables, see: