Introduction

In this article, you will learn how to:

• Understand and assess an ARO
• Take action to resolve the issue
• Request help if needed
• Close the ARO correctly

To better understand the information provided in each ARO, see The Anatomy of an ARO, or our Help Center chapter.

This article covers the following topics

• ARO Workflow Overview
  • Partner Workflow (Using Vision)
  • Receive & Review the ARO
  • Take Action on the Issue
    • For Partners Using Vision
  • Request Help (Optional)
  • Close the ARO
    • Example: MFA Disabled (ARO-19)
    • Closing AROs as a Partner
• Finding Closed AROs

ARO Workflow Overview

Every ARO that generated follows the same life cycle:

1. Receive the ARO in the MDR Portal (Open status)
2. Take action to fix the root cause
   
3. (Optional) Request help from Field Effect
4. Close the ARO (Resolve or Dismiss)

Partner Workflow (Using Vision)

If you are a Field Effect partner, your workflow may differ slightly:

1. Review the ARO in the MDR Portal
2. Assess scope across client environments
3. Take action in Vision (when applicable)
4. Request help if analyst support is needed
5. Close the ARO once resolved or intentionally dismissed

Receive & Review the ARO

When an ARO is generated, it appears on the MDR Portal's AROs page with an Open status.

What to do:

• Read the description to understand the issue
• Validate the issue
• recommendations in the ARO and the suggested mitigation steps=

Address the Issue

Each ARO includes guidance to help you resolve it. Use this guidance to address the vulnerability or issue the ARO is alerting on. 

Examples:

• Enable MFA for a user
• Uninstall malicious software and update out of date software
• Investigate suspicious activity
• Remediate vulnerabilities
• If relevant, build IOCs list for use removing the issue from multiple hosts
• If relevant, search across all hosts for similar issues

For Partners Using Vision

You can take direct action from Vision to accelerate remediation or act quickly across multiple client organizations. You can:

• Isolate or unisolate endpoints
• Run quick scans
• Manage endpoints or accounts

Request Help (Optional)

If you need assistance with the ARO:

1. Open the challenging ARO 
2. Click Request Help
3. Enter your message or request

You can:

• Ask questions about the ARO
• Request analyst actions (e.g., isolate an endpoint)
• Provide additional context

Sensitive information: Enable the sensitive data option to keep details private within the portal.

Close the ARO

Once the issue is addressed, close the ARO. When closing an ARO, it can be either resolved or dismissed.

Quick Rule:

• Resolve = "I fixed the problem, but continue monitoring and tell me about it if it recurs"
• Dismiss = "I didn't fix the problem, was a false positive or something that I accept. Don't tell me about it again."

If at any time there is not a suitable Resolve or Dismiss option available, use the Request Help button to tell us what you want to do. This will trigger discussion with our SOC for your custom resolution.

Example: MFA Disabled (ARO-19)

If a user disables MFA:

• Resolve: You have re-enabled MFA and want alerts if it happens again.

• Dismiss (user-specific): You accept this for one user → future alerts suppressed for that user.

• Dismiss (global): You accept this risk → no future MFA alerts. 

Closing AROs as a Partner

When managing multiple clients, be cautious with Dismiss options that suppress alerts broadly.

Always confirm whether the dismissal applies:

• To a single user or asset
• To a specific behavior
• Globally across environments

Finding Closed AROs

Use the status filter on the AROs page to view resolved or dismissed AROs.

Dealing with False Positives or Custom Dismiss Options

If you notice repeated AROs about a topic that you would like dismissed, please gather these examples and how you would like them handled and submit a ticket to Support via either the Help Center or by emailing support@fieldeffect.com.

New clients often see more AROs that they will want to dismiss than they will see from ongoing service. Please use dismiss options and messages to Support to help us tune our detections to your environment.