We have a CrossVendorRepeatedFailedLoginAttempts rule that auto-resolves and I am not sure what is the condition that actually causes this rule to resolve.
The alert's rule is based on NumericThresholdOnDoubleMetricWithItemsTemplateRule and as far as I can tell it doesn't have any parameter that defines when it should auto-resolve.
I think that you understnd the issue with the auto resolve. Can you share?
We have one of our rule-writers, investigating. In this particular case, we shouldn't be auto-resolving at all, so knowing why this is occuring would be beneficial to share.
The alert is resolving when the condition for it is no longer true. In this case, when the number of failed login attempts by the user is less than 3. This is a usual template based alert and it does resolve automatically in the same way as the other ones.