Resolving Alerts | cside docs

When threat detection flags a script, cside raises an alert. Every alert offers Resolve. URL, IP, hostname, and domain targets can also offer Block when your team has blocking access. Hash alerts offer Resolve only.

Alert resolution is separate from PCI DSS review and approval. Resolving an alert records your investigation; it does not approve a vendor for PCI DSS or block a script.

Finding your alerts

Open Alerts in the dashboard. You can also click the pending-alert indicator on Home to open pending alerts across all team domains.
Use the domain selector at the top of Alerts to choose a domain. Type part of its name to search, or select All Domains for the team-wide view.
Alerts are grouped by the ruleset that raised them. Each group is an expandable card showing the ruleset name and description, a Low risk, Medium risk, or High risk badge derived from the ruleset’s 1-10 risk score, and how many alerts in the group are pending and resolved. Groups are ordered by risk score, highest first.
Expand a card to list its alerts. Each row shows the Type, Target, Impacted Scripts, and Last Triggered time, plus a Domain column on the all-domains view, and has an inline Resolve button.
Open a row to investigate the alert and use Resolve, or Block for a supported non-hash target.

Use the Status filter (Show only pending alerts) to hide alerts your team has already handled, and the search box to find a specific target. A resolved alert shows a Resolved badge in place of its Resolve button.

Switching domains preserves your target search and pending-only filter. The selector supports one domain at a time or All Domains. See Dashboard navigation for the other domain pickers and Home totals.

Risk badges use scores 1-3 for low, 4-7 for medium, and 8-10 for high risk. Resolve all applies to the selected ruleset group in the current domain scope: the selected domain, or all team domains when All Domains is selected. Review that scope before confirming.

Resolving a whole group

When a group has pending alerts, its table header shows a Resolve all button. Click it, enter a reason in the Resolve All Alerts dialog (a comment is required), and confirm with Resolve all. Very large groups are resolved in batches; if some alerts remain pending, run Resolve all again after a few minutes.

An alert for a specific script (a hash-based target) drops off this list once that script hasn’t been seen on your site in 90 days, so the table doesn’t fill up with alerts for scripts that are already gone. URL, IP, domain, and hostname alerts aren’t affected by this. A hidden alert reappears if the script is served again within the 90-day window, and a direct link to an alert’s detail view keeps working even after it drops off the list.

Resolve

Resolve marks an alert as reviewed. Use it when you have looked at the flagged script and decided it does not need to be blocked, for example a change you authorized, a known vendor update, or a false positive.

Resolving does not block the script; it keeps running exactly as before. It records that your team reviewed the alert and stops the matched rules from re-alerting on this target.

To resolve an alert:

Open the alert from the Alerts table.
Click Resolve.
In the Resolve Alert dialog, enter a reason in the comment field. A comment is required.
Click Resolve to confirm.

The status badge changes to Resolved, and you see an Alert resolved. confirmation.

Resolving stops future alerts for this target only for the rules that matched. If a different rule matches the same target later, it can still raise a new alert.

Block

Block stops scripts matching the target from executing in your visitors’ browsers. The button is labeled with the target type, such as Block URL or Block IP. Hash alerts don’t have a Block action, only Resolve.

To block a target:

Open the alert from the Alerts table.
Click the Block button.
In the Block Target dialog, enter a reason in the comment field. A comment is required.
Click Block to confirm.

You see a confirmation that the target has been blocked. A new block takes effect once visitors receive the updated cside script configuration.

Blocking is enforced by the cside script in your visitors’ browsers, so it applies to domains running in Script Method. Scan Method domains have no runtime enforcement: use a Content Security Policy header to stop unauthorized scripts from loading. See Scan Method setup.

Resolve vs. Block

Action	What it does	When to use it
Resolve	Marks the alert as reviewed and stops the matched rules from re-alerting on this target. Does not block the script.	The flagged script is expected or safe, and you want to clear the alert.
Block	Stops matching scripts from executing in your visitors’ browsers. Not available for hash alerts.	The flagged script is unwanted and you want cside to stop it from loading.

Reviewing what happened

Open an alert and use its tabs to investigate before you act:

Payload shows the flagged script content for hash targets. For URL, IP, domain, and hostname targets this tab is called Destination and shows where the target points.
Impacted Scripts lists the scripts the alert covers.
History records Resolve actions and, for supported targets, Block actions, including who acted and when.
Rulesets shows the rules that matched.

After you resolve an alert, the History tab records which rules were resolved and the team member who resolved them.