When an incident is disabled in Incident Settings, future incidents are suppressed. Incidents that are already raised incidents will stay in raised state. When the raised incident is cleared, the default notification profile is used to notify the customer, and the notification profiles from the incident settings are not used.

If the incident policies (with different notification profiles) that match Raised Incidents are removed, the Clear Incident event is published using default notification profile.

When two people are configuring or modifying the same notification profile, only the final changes are reflected.

SPN Capacity incidents INC_RN_SPN_LONG_DURATION_CAPACITY_EXCEEDED_THRESHOLD and INC_RN_SPN_LONG_DURATION_EXCEEDED_CAPACITY will not be blocked at the RN site classification level, because there is no resource_key or resource_context of site_name used. Customers may be confused by being able to create Incident Settings rules for this code, as the site classification doesn't work.

On the

Incidents and Alerts: Prisma Access

Incident Settings

page, if you create custom CODE rules, CATEGORY rules may never get triggered.