Incident should be closed immediately once it's created if a short description contains "xxxxxxxxxx"

Nagurbee1 · ‎02-28-2024

Hi Team

Recently I got a one requirement that Incident should be auto closed immediately once it's created if a short description contains "xxxxxxxxxx" and watch list contains "xxxx email id" and assignment group is "xxxx".

In my instance , every day one incident is getting created and auto assigning to a group "xxxx", so "xxxx" group people requested us be auto close it immediately once it's created in ServiceNow as they don't that ticket any more.

Could you please suggest that how to auto close the incidents if the above conditions are met ?

Thanks in advance

Nagurbi

Amit Verma · ‎03-03-2024

Hi @Nagurbee1

Probably, it's a flow then which is creating the incident on the reception of email. Search for flows with trigger type as email and check. Also, creating a before insert business rule on the incident table should do the trick as you are restricting the insert operation itself which is independent of the source.

For the issue with selecting a dynamic watch list recipient, can you please confirm if you have an account created for the DL in your instance. If not, then we need to script the condition to check Watch List users.

Thanks & Regards

Amit Verma

Please mark this response as correct and helpful if it assisted you with your question.

View solution in original post

AshishKM · ‎03-14-2024

i think, we are missing the main point, as you mention "I am not aware of the source of the incident creation", need to investigate the source first then consider the corrective/preventive action. Here you have chosen the defective approach. There may be other sources trying to connect the instance for various reason.

At end of day, how will you measure such unwanted incident count.

Please mark this response as correct and helpful if it helps you can mark more that one reply as accepted solution

James Chun · ‎02-28-2024

Hey @Nagurbee1,

I guess you can write some BR to auto-close the incident that meets the conditions.

But wouldn't it be better to prevent these incidents from being created in the first place?

If you keep creating these incidents, your reports/metrics may be less reliable.

Cheers

Nagurbee1 · ‎03-14-2024

Hello James

I have prevented incident creation it self using before insert business rule.

Thank you so much for your suggestion.

Amit Verma · ‎02-28-2024

Hi @Nagurbee1

You should not let the incident to be created at first place. To avoid the insert option, you can create a before insert business rule on the incident table with condition as short description contains "xxxxxxxxxx" AND watch list contains "xxxx email id" AND assignment group is "xxxx".

In the action section, check the Abort Action Checkbox to abort the insert option. Please give this a try and let me know if you need any further assistance.

Thanks & Regards

Amit Verma

Please mark this response as correct and helpful if it assisted you with your question.

Nagurbee1 · ‎03-01-2024

Hello Amit

Thank you so much for the quick response 🙂

I am not sure from which script these incidents are getting created in my instance, but my instance is receiving a mail from the email id "xxxx" every day and after that only incident is getting created in incident table.

But don't see any inbound action too for incident creation with the above condition.

So my question is If I create a before insert business rule as per your suggestion , will that stop the incident creation irrespective of the source of that creation ?

And in conditions sections of business rule , I can't give the watch list contains "XXXX DL email id" as it refers to the users table, do you have any suggestion for this ?

Thanks in advance

Nagurbi