SkieWhat does Resolve do in the breach centre?
Resolve closes alerts for devices that have recovered, such as a tablet that was silent and has now reported in. Alerts for devices that are still broken stay open, so resolving at a high level cannot hide a real problem. It tidies the list; it does not fix a device.
The breach centre is meant to be a to-do list, and a to-do list has to be able to get shorter. Resolve is how it does that.
When you press resolve, Skie looks at each alert in scope and checks whether the underlying condition has cleared. A silent device that has now reported in is recovered, so its alert closes. A device that has returned inside its geofence is recovered. A device that is still silent, still outside the zone, or still missing a protection is not recovered, so its alert stays open.
That behaviour is deliberate. It means resolve is safe to press on a group, branch, school or whole organisation after an event like a power cut. You do not have to read every line first, and you cannot accidentally clear something that still needs a person.
Resolve does not change a device. It does not re-apply a policy or restore a protection. If a protection is off, the self-heal and the next sync deal with it, and compliance is read back after every apply. Resolve only records that the problem has gone. If you want a device to report in first, use sync, which is covered in sync and resolve at each level.
Practical tip: do not use resolve as a way of making the list look clean. If an alert keeps coming back for the same device, treat that as the real finding. A device that repeatedly goes silent has a charger, signal or handling problem worth fixing.