# Failed to close Detection alert

**URL:** <https://discuss.elastic.co/t/failed-to-close-detection-alert/256407>\
**Category:** SIEM\
**Created:** [November 23, 2020, 9:32pm UTC](https://discuss.elastic.co/t/failed-to-close-detection-alert/256407 "2020-11-23T21:32:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [November 23, 2020, 9:32pm UTC](https://discuss.elastic.co/t/failed-to-close-detection-alert/256407/1 "2020-11-23T21:32:24Z")

</div>

Hello,

Version 7.9.2

I was trying to clean up / close some old alerts and I get the following error:

![image](https://us1.discourse-cdn.com/elastic/original/3X/2/c/2c48743e9843f2c6d0f9ccd9e940be78e0c2a49a.png)

Known issue?

In the Kibana logs I find a 409:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/9/19863ae63c8a5d9be79a41f8b1eb55dc3837e8db.png)

Request referrer:

`https://kiburl:5601/app/security/detections?filters=!((%27$state%27:(store:appState),meta:(alias:%27Noisy%20SIEM%20Rules%27,disabled:!t,key:signal.rule.tags,negate:!t,params:!(Noisy),type:phrases,value:Noisy),query:(bool:(minimum_should_match:1,should:!((match_phrase:(signal.rule.tags:Noisy)))))),(%27$state%27:(store:appState),meta:(alias:!n,disabled:!f,key:signal.status,negate:!t,params:(query:closed),type:phrase),query:(match:(signal.status:(query:closed,type:phrase)))),(%27$state%27:(store:appState),meta:(alias:!n,disabled:!f,key:signal.rule.tags,negate:!f,params:!(APM),type:phrases,value:APM),query:(bool:(minimum_should_match:1,should:!((match_phrase:(signal.rule.tags:APM)))))),(%27$state%27:(store:appState),meta:(alias:!n,disabled:!f,key:signal.rule.name,negate:!f,params:(query:%27Web%20Application%20Suspicious%20Activity:%20No%20User%20Agent%20(excl%20known%20url.path%20values)%27),type:phrase),query:(match:(signal.rule.name:(query:%27Web%20Application%20Suspicious%20Activity:%20No%20User%20Agent%20(excl%20known%20url.path%20values)%27,type:phrase)))))&timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-11-23T21:22:16.942Z%27,fromStr:now-1y,kind:relative,to:%272020-11-23T21:22:16.942Z%27,toStr:now)),timeline:(linkTo:!(global),timerange:(from:%272019-11-23T21:22:16.942Z%27,fromStr:now-1y,kind:relative,to:%272020-11-23T21:22:16.942Z%27,toStr:now)))`

Grtz

Willem

---

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [November 23, 2020, 9:34pm UTC](https://discuss.elastic.co/t/failed-to-close-detection-alert/256407/2 "2020-11-23T21:34:44Z")

</div>

Seem that after a lot of trying / sorting and reselecting all, I was able to delete all signals I wanted to delete. Not sure what was going on.

---

<div class="post-metadata">

**Author:** ![yctercero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yctercero/32/68560_2.png) [@yctercero](https://discuss.elastic.co/u/yctercero)\
**Post date:** [November 30, 2020, 2:53pm UTC](https://discuss.elastic.co/t/failed-to-close-detection-alert/256407/3 "2020-11-30T14:53:41Z")

</div>

Hey @willemdh !

Wonder if the alerts had been deleted already in another tab or by another user sharing the space giving the 409. Anyways, glad to hear you got it working!

Best,  
Yara

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2020, 2:53pm UTC](https://discuss.elastic.co/t/failed-to-close-detection-alert/256407/4 "2020-12-28T14:53:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.