We've improved handling for malware incidents in the following ways:
Alert notifications
There existed potential for an excessive number of malware notifications and login popups to appear in cases where a single device generates multiple events within a brief span of time.
We've amended the alerting mechanism to restrict alert notifications to two per day, per device. If a second malware alert occurs within a 24 hours period on the same device, a new alert will be sent to inform recipients of multiple malware incidents on the device.
Additional incidents from the same device will not result in an alert notification until the full 24-hour period has passed.
Automated actions for similar incidents
If you are closing or completing an incident and there are multiple open or new incidents for the same device, the system will now ask if you wish to close/complete all open/new malware incidents for the device. Simply select the check box and confirm to perform the same action on all similar incidents on the device.
Display active incidents by default
We've updated the Security page display to show only the incidents that are not in a Complete state.
We've also added a Show Completed Incidents check box that you can select if you wish to see all incidents:
