# How to reopen an accidental closing of all alerts

**URL:** <https://discuss.elastic.co/t/how-to-reopen-an-accidental-closing-of-all-alerts/369082>\
**Category:** Elastic Security\
**Created:** [October 18, 2024, 6:22pm UTC](https://discuss.elastic.co/t/how-to-reopen-an-accidental-closing-of-all-alerts/369082 "2024-10-18T18:22:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![just4bs](https://avatars.discourse-cdn.com/v4/letter/j/67e7ee/32.png) [@just4bs](https://discuss.elastic.co/u/just4bs)\
**Post date:** [October 18, 2024, 6:22pm UTC](https://discuss.elastic.co/t/how-to-reopen-an-accidental-closing-of-all-alerts/369082/1 "2024-10-18T18:22:00Z")

</div>

I was working on an alert and ended up closing all of the alerts on the server. Is there a way to reopen the ones I closed at a certain time? I assume I need to be able to see when I did it first. Thanks in advance.

---

<div class="post-metadata">

**Author:** ![ashokaditya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashokaditya/32/77783_2.png) [@ashokaditya](https://discuss.elastic.co/u/ashokaditya)\
**Post date:** [October 21, 2024, 7:15am UTC](https://discuss.elastic.co/t/how-to-reopen-an-accidental-closing-of-all-alerts/369082/2 "2024-10-21T07:15:23Z")

</div>

> [@just4bs](#):
>
> working on an alert and ended up closing all of the alerts on the server. Is there a way to reopen the ones I closed

Hi David,

Thanks for reaching out. When you say you were working on an alert, is it possible for you to tell what interface/page/URL you were on? Also, I'm curious to know how you closed all alerts. Is it also possible for you to provide a screenshot or some more context?

At this point, I'm assuming they were Endpoint alerts from your server, if yes, did you try and visit the Alerts page (/app/security/alerts) and try to find the alerts you closed?

---

<div class="post-metadata">

**Author:** ![just4bs](https://avatars.discourse-cdn.com/v4/letter/j/67e7ee/32.png) [@just4bs](https://discuss.elastic.co/u/just4bs)\
**Post date:** [October 21, 2024, 12:27pm UTC](https://discuss.elastic.co/t/how-to-reopen-an-accidental-closing-of-all-alerts/369082/3 "2024-10-21T12:27:00Z")

</div>

![elastic oops](https://us1.discourse-cdn.com/elastic/original/3X/7/5/7552665bcc7ec3ddd5fbac82ee941072431346e8.jpeg)

I was working on an alert and didn't notice that while working on it, I didn't filter out the 1 I was doing. I was working on the main set. I selected the large number and closed everything. The alerts that are closed still exist, but now I have 3300 alerts to go back and re-open. Is there a method to filter out the time, date and user to help me change the status back to open?

---

<div class="post-metadata">

**Author:** ![Nikita\_Khristinin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikita_khristinin/32/102092_2.png) [@Nikita\_Khristinin](https://discuss.elastic.co/u/Nikita_Khristinin)\
**Post date:** [October 22, 2024, 3:09pm UTC](https://discuss.elastic.co/t/how-to-reopen-an-accidental-closing-of-all-alerts/369082/4 "2024-10-22T15:09:49Z")

</div>

Hello! Not sure, you can do it from UI, but in Kibana Console you can try this request

```auto
POST /.alerts-security*/_update_by_query
{
  "script": {
    "source": "ctx._source['kibana.alert.workflow_status'] = 'open';",
    "lang": "painless"
  },
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "kibana.alert.workflow_user": "you_user_id"
          }
        },
        {
          "range": {
            "kibana.alert.workflow_status_updated_at": {
              "gte": "now-10m",
              "lte": "now"
            }
          }
        }
      ]
    }
  }
}

```

please change your `workflow_use`r and `workflow_status_updated_at` for you use case

this should open alerts in this time range for you user

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 19, 2024, 3:10pm UTC](https://discuss.elastic.co/t/how-to-reopen-an-accidental-closing-of-all-alerts/369082/5 "2024-11-19T15:10:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.