---
id: manage-custom-insight-resolutions
title: Manage Custom Insight Resolutions
sidebar_label: Manage Custom Insight Resolutions
description: Learn how to create custom sub-resolutions that you can select when closing an insight.
slug: /help/docs/cse/administration/manage-custom-insight-resolutions/
canonical: https://www.sumologic.com/help/docs/cse/administration/manage-custom-insight-resolutions/
---

import useBaseUrl from '@docusaurus/useBaseUrl';

This topic has information about custom insight resolutions and how to create and manage them.

## About insight resolutions

When you close an insight, Cloud SIEM prompts you to select a resolution that indicates why you closed it. There are four built-in resolutions:

* Duplicate. The insight has triggered before on the same entity and is a duplicate.
* False Positive. An insight triggered and it is legitimate activity.
* No Action. An insight triggered and it might not be an incident but is also not a false positive.
* Resolved. An incident occurred and was resolved.

You can define custom *sub-resolutions* for any of the built-in resolutions. This enables you to create more granular resolutions that indicate more clearly why an insight was closed. For example, you might want to create a “Remediated” sub-resolution under “Resolved”.

import TerraformLink from '../../reuse/terraform-link.md';

:::tip
You can use Terraform to manage custom insight resolutions with the [`sumologic_cse_insights_resolution`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_insights_resolution) resource.

<TerraformLink/>
:::

## Create a custom sub-resolution

1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Cloud SIEM**, and then under **Cloud SIEM Workflow** select **Insight Resolutions**. You can also click the **Go To...** menu at the top of the screen and select **Insight Resolutions**.  <br/>[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top Cloud SIEM menu select **Configuration**, and then under **Workflow** select **Resolutions**. 
1. On the **Insight Resolutions** tab, click **+ Add Resolution**. 
1. The **Add Insight Resolution** popup appears.
    1. **Name**. Enter a meaningful name for the new resolution.
    1. **Parent Resolution**. Display the dropdown list and select a built-in resolution.
    1. **Description**. (Optional) Enter a description that will help other users understand when to use the new resolution.
    1. Click **Save**. <br/><img src={useBaseUrl('img/cse/create-insight-resolution.png')} alt="Create insight resolution dialog" style={{border: '1px solid gray'}} width="400"/>

The new resolution appears on the **Insight Resolutions** tab, indented below the parent resolution. 

## Close an insight using a custom resolution

1. After navigating to an insight, you can close it by either clicking the **Close Insight** button or by selecting **Closed** from the **Status** pulldown.  <br/><img src={useBaseUrl('img/cse/close-options.png')} alt="Close options" style={{border: '1px solid gray'}} width="300"/> <br/>The **Close Insight** dialog box appears.<br/><img src={useBaseUrl('img/cse/close-insight.png')} alt="Close insight dialog" style={{border: '1px solid gray'}} width="400"/>
1. Click **Resolution**. The list of resolutions appears, including any custom sub-resolutions that have been defined. <br/><img src={useBaseUrl('img/cse/resolution-options-2.png')} alt="Close insight dialog" style={{border: '1px solid gray'}} width="400"/>
1. Click the appropriate resolution for the insight.
1. In **Additional Comments** add a comment if desired. 
1. Click **Close Insight** to apply the selected resolution and close the insight.

## Filter insights by custom resolution

You can filter insights by custom resolution.

1. On the **Insights** page, check the **Filters** area and make sure that the **Status** filter is not set to “is not closed”.  
1. Click in the **Filters** area and select **Custom Resolution**.  <br/><img src={useBaseUrl('img/cse/filter-option.png')} alt="Filter options" style={{border: '1px solid gray'}} width="400"/>
1. You’re prompted to select an operator: **is** or **is not**. 
1. After you choose an operator, you're prompted to select a custom resolution.  
1. Select a resolution to view insights that have that resolution.