Closing An Active Incident
Incidents are automatically closed when all the reported footholds have been removed from the host. The agent will detect the change and the console will be updated. If you just remediated, it may take about 15 minutes for the console to update (the agent surveys the host at regular intervals.)
In cases where you have wiped the host, you will need to uninstall the agent which will close the incident.
There are a few instances where you may have removed the footholds and yet the incident is still open. Those are covered here.