Hello Community,
We are using Event Management to create alerts and related incidents in ServiceNow.
We have observed the following behavior:
• Alerts are created from incoming events.
• In some cases, no subsequent event updates (clear/resolve) are received.
• After 7 days of no event response, the alert is automatically closed.
• Once the alert is closed, the associated incident is automatically moved to Resolved.
I wanted to check:
• Is this out-of-the-box (OOB) behavior in ServiceNow Event Management?
• Is there any default alert lifecycle, timeout, or system property that controls this 7-day auto-closure?
• Are there any OOB jobs, rules, or alert management configurations that could trigger this behavior?
I’ve reviewed our instance and did not find any custom (non-OOB) flows, business rules, or jobs related to this logic, so I’m trying to confirm whether this is standard platform behavior.
Any guidance or pointers would be greatly appreciated.
Thank you,
Laxma
