Resolving Alerts | cside docs

When threat detection flags a script on your site, cside raises an alert in the dashboard. Each alert has two actions: Resolve and Block. This page explains what each one does and when to use it.

Resolving an alert is separate from the PCI compliance review flow. The Alerts page uses Resolve and Block; the PCI DSS dashboard uses Review and Approve. The two are independent.

Finding your alerts

Open the dashboard and select your domain from the left sidebar, or stay at the team level to see alerts across all domains.
Go to Alerts.
Alerts are grouped by the ruleset that raised them. Each group is an expandable card showing the ruleset name and description, a Low risk, Medium risk, or High risk badge derived from the ruleset’s 1-10 risk score, and how many alerts in the group are pending and resolved. Groups are ordered by risk score, highest first.
Expand a card to list its alerts. Each row shows the Type, Target, Impacted Scripts, and Last Triggered time, plus a Domain column on the all-domains view, and has an inline Resolve button.
Click a row to open the alert’s detail view, where the Resolve and Block actions live.

Use the Status filter (Show only pending alerts) to hide alerts your team has already handled, and the search box to find a specific target. A resolved alert shows a Resolved badge in place of its Resolve button.

Resolving a whole group

When a group has pending alerts, its table header shows a Resolve all button. Click it, enter a reason in the Resolve All Alerts dialog (a comment is required), and confirm with Resolve all. Very large groups are resolved in batches; if some alerts remain pending, run Resolve all again after a few minutes.

An alert for a specific script (a hash-based target) drops off this list once that script hasn’t been seen on your site in 90 days, so the table doesn’t fill up with alerts for scripts that are already gone. URL, IP, domain, and hostname alerts aren’t affected by this. A hidden alert reappears if the script is served again within the 90-day window, and a direct link to an alert’s detail view keeps working even after it drops off the list.

Resolve

Resolve marks an alert as reviewed. Use it when you have looked at the flagged script and decided it does not need to be blocked, for example a change you authorized, a known vendor update, or a false positive.

Resolving does not block the script; it keeps running exactly as before. It records that your team reviewed the alert and stops the matched rules from re-alerting on this target.

To resolve an alert:

Open the alert from the Alerts table.
Click Resolve.
In the Resolve Alert dialog, enter a reason in the comment field. A comment is required.
Click Resolve to confirm.

The status badge changes to Resolved, and you see an Alert resolved. confirmation.

Resolving stops future alerts for this target only for the rules that matched. If a different rule matches the same target later, it can still raise a new alert.

Block

Block stops scripts matching the target from executing in your visitors’ browsers. The button is labeled with the target type, such as Block Hash, Block URL, or Block IP.

To block a target:

Open the alert from the Alerts table.
Click the Block button.
In the Block Target dialog, enter a reason in the comment field. A comment is required.
Click Block to confirm.

You see a confirmation that the target has been blocked. A new block takes effect once visitors receive the updated cside script configuration.

Blocking is enforced by the cside script in your visitors’ browsers, so it applies to domains running in Script Method. Scan Method domains have no runtime enforcement: use a Content Security Policy header to stop unauthorized scripts from loading. See Scan Method setup.

Resolve vs. Block

Action	What it does	When to use it
Resolve	Marks the alert as reviewed and stops the matched rules from re-alerting on this target. Does not block the script.	The flagged script is expected or safe, and you want to clear the alert.
Block	Stops matching scripts from executing in your visitors’ browsers.	The flagged script is unwanted and you want cside to stop it from loading.

Reviewing what happened

Open an alert and use its tabs to investigate before you act:

Payload shows the flagged script content for hash targets. For URL, IP, domain, and hostname targets this tab is called Destination and shows where the target points.
Impacted Scripts lists the scripts the alert covers.
History records each Resolve or Block action, who took it, and when.
Rulesets shows the rules that matched.

After you resolve an alert, the History tab records which rules were resolved and the team member who resolved them.