cylonsurfer

Thanks, No the alert status is still active for each for alerts, the state has not changed to 'cancel'.

Thats correct - the alerts, once triggered remain active even although the malware which triggered the alert was cleaned and I can see no way to manually dismiss the alerts and they do not appear to be resolving automatically. We're currently on version: 1706 - Site Version: 5.00.8540.1000

Anyone here using SCCM CB that would kindly comment?

Is there seriously no one that knows anything about SCCM Alerts? I've looked everywhere on the web and can find nothing to indicate what we should be doing with SCCM alerts once they have triggered - do you all just live with them cluttering up the alerts dashboard?

I have configured a number of Malware alerts in SCCM CB and have tested them against a test client which I infected with the EICar test file. The configured alerts all trigger as expected and fire off emails to the addresses I have specified - which is great. However once triggered these alerts seem to remain in a state of 'Active' under 'Monitoring' > 'Overveiw' > 'Alerts' > 'All Alerts' / 'Active Alerts' despite the malware being successfully removed from the client via Endpoint Protection and the client reporting a remediation status of 'Cleaned' back to SCCM. I can see no way to dismiss these alerts or manually mark them as resolved - what do I do with them and should they automatically change state once the issue that triggered them has been resolved? It's been over 48 hours since the Malware was detected (and removed) by Endpoint and the alert triggered in SCCM.