Edit Alerts
After an alert is published, you can edit it up to one hour after it is published. After one hour, you get the option to update the alert. For drafted alerts, you can edit the required alert details except for the Indicators, Threat Assessment, and Recommended Actions sections. While you are editing a drafted alert:
The alert creation form is locked for other analysts, which allows you to make changes to the alert for a specified time limit. This time limit is configured in Administration > Configuration. For more information, see Configure Alerts Settings.
Note
Save your changes before this time limit lapses to ensure your changes are not lost. You will receive a reminder to save your changes.
If another analyst is currently editing a draft alert, the alert is locked and you will not be able to edit the alert. This lock indicates the remaining time for the other analyst to complete their edits. After the specified time has lapsed, the alert will be unlocked and ready for you to edit. Additionally, you can view the name of the analyst currently editing the alert, along with the remaining time.
Steps
To edit an alert, do the following:
Sign in to the Analyst Portal and click Alerts. The Alerts list is displayed.
Click the vertical ellipsis of an alert you want to update, and click Edit.
Make the required changes to the alert in the available sections. Sections that are disabled are not available for you to make edits.
If you are prompted to save changes and continue as a reminder, click OK.
After updating details, click Preview & Publish. You can also choose to save the alert as a draft or expire the alert.