What happens to alerts in Sophos Central if malware is successfully cleansed automatically?

When malware is successfully cleansed automatically in Sophos Central, the alert associated with that incident is updated to reflect the action taken. This process typically involves changing the status of the alert to indicate that the issue has been resolved, rather than simply deleting it or dismissing it permanently.

Maintaining a record of alerts, even after they have been addressed, is important for tracking and auditing purposes. Therefore, while the alert does not remain unchanged in the event list, it will not be deleted outright. Instead, the status change provides transparency on the previous threats detected and the actions taken to remediate them, which can be valuable for later analysis and security reviews. Thus, the alert gets a new status that confirms it has been dealt with accordingly.