With Third Wall v2.5.2.6, we added two checkbox options to the Utilities section of the Preferences page:

By default, these checks are not enabled.  Third Wall recommends enabling both options.

These two checks impact the ticket behavior of the Alert on Excessive Logon Failures and Monitor Event Log Clearing policies.  When enabled, Third Wall will cause the tickets from these two policies to not auto-resolve.  This means tickets from these to policies will have to be closed manually.

This is a recommended setting as there is no automatic solution available to these issues.  A technician upon receipt must perform a discovery.  This discovery may be wholly technical, may involve speaking to the user or both.  Because of the variance in appropriate responses, manual closing of the ticket upon completion is appropriate.

These two options are a result of our finding Automate making unrequested changes to the ticket behavior.  When this occurs, both fields, 'Alert Message on Success' and 'Alert Message on Failure' will be populated, as show below:

This will result in any tickets thrown by the monitor to auto-close five minutes after being issued.  The desired structure is shown here:

Unfortunately, the Automate UI will not allow that field to be left unpopulated.  When it is, on update, Automate will auto-populate the field.