Remediate an incident Remediation is the process of acknowledging an incident and restoring access. Remediating a custom incident The following example will demonstrate how to restore access to "John Doe", who was flagged for the investigation via a custom incident. Navigate to the Incidents - Summary page. Click the button that corresponds to John’s incident in the View column. (Optional) Click Acknowledge, and again in the dialog. Acknowledging incidents is not required prior to lifting any blocks. It is a way to indicate the issue has been seen and is being addressed. If the user is blocked, restore access to the account: Click Restore Access. Select Unblock and block immediately if detected again. Check the box next to John’s email or username. Click Unblock. Click Close Incident, and again in the dialog. When remediating an incident, they won’t always come with user/host blocks applied as demonstrated in the prior example. If an incident is below 7.5 on the severity scale, no blocks will be applied due to the default rules and the Restore Access steps can be skipped.