How to close/resolve an incident using an inbound email

[SamuelNjeri]

Hello Team,

Has anybody achieved closing/resolving an incident from inbound email which is separate and dont have a common link to the 1st email.

The system generate an initial email for an alert then generate anohter separate email for alert clearance. There is no event ID and would like to use maybe the subject to search the incident created so that the 2nd email can resolve it.

Thanks

[Ankur Bawiskar]

@SamuelNjeri 

Unless an email is sent to caller on existing INC how would the caller respond to close/resolve the INC and without this the inbound action can't identify email coming is for which INC

that's basic concept of Reply type inbound action

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[SamuelNjeri]

@Ankur Bawiskar 

There are some parameters which are common for both emails. The 1st indicate the alert is still open whereas the 2nd indicate the alert is cleared. The occurence time and alarm source is same in both emails. How do I use the common parameters to search an incident from incident table and change its status to resolved?

[Ankur Bawiskar]

@SamuelNjeri 

in your inbound action you need to handle the logic

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏