Skip to main content
Finding your alerts
Language

Resolving Alerts

Learn how to resolve or block a script alert in the cside dashboard, and when to use each action.

When threat detection flags a script on your site, cside raises an alert in the dashboard. Each alert has two actions: Resolve and Block. This page explains what each one does and when to use it.

Resolving an alert is separate from the PCI compliance review flow. The Alerts page uses Resolve and Block; the PCI DSS dashboard uses Review and Approve. The two are independent.

Finding your alerts

  1. Open the dashboard and select your domain from the left sidebar.
  2. Go to Alerts.
  3. The table lists each alert with its Type, Target, Impacted Scripts, Last Triggered time, and the Rules that matched. Use the Show filter to switch between Pending alerts and All alerts.
  4. Click an alert row to open its detail view, where the Resolve and Block actions live.

An alert’s Status shows as Pending until someone acts on it. Once you resolve it, the status changes to Resolved.

Resolve

Resolve marks an alert as reviewed. Use it when you have looked at the flagged script and decided it does not need to be blocked, for example a change you authorized, a known vendor update, or a false positive.

Resolving does not block the script and does not change how the script is served. It records that your team reviewed the alert and stops the matched rules from re-alerting on this target.

To resolve an alert:

  1. Open the alert from the Alerts table.
  2. Click Resolve.
  3. In the Resolve Alert dialog, enter a reason in the comment field. A comment is required.
  4. Click Resolve to confirm.

The status badge changes to Resolved, and you see an Alert resolved. confirmation.

Resolving stops future alerts for this target only for the rules that matched. If a different rule matches the same target later, it can still raise a new alert.

Block

Block prevents scripts matching the target from being served on your site. The button is labeled with the target type, such as Block Hash, Block URL, or Block IP.

To block a target:

  1. Open the alert from the Alerts table.
  2. Click the Block button.
  3. In the Block Target dialog, enter a reason in the comment field. A comment is required.
  4. Click Block to confirm.

You see a confirmation that the target has been blocked. New blocks may take time to propagate globally.

Blocking only stops a script from being served if that script is proxied through cside. A new block can take time to propagate across cside’s edge.

Resolve vs. Block

ActionWhat it doesWhen to use it
ResolveMarks the alert as reviewed and stops the matched rules from re-alerting on this target. Does not block the script.The flagged script is expected or safe, and you want to clear the alert.
BlockPrevents scripts matching the target from being served (proxied scripts only).The flagged script is unwanted and you want cside to stop it from loading.

Reviewing what happened

Open an alert and use its tabs to investigate before you act:

  • Payload shows the flagged script content.
  • Impacted Scripts lists the scripts the alert covers.
  • History records each Resolve or Block action, who took it, and when.
  • Rulesets shows the rules that matched.

After you resolve an alert, the History tab records which rules were resolved and the team member who resolved them.

Was this page helpful?