How to Disable Automatic Incident Resolution for OK Severity Alerts in ServiceNow?

[SathishB]

If the alert severity is OK, the respective incident resolves automatically. For learning purposes, I need to deactivate that process. I checked the Flow, Alert Management Rule, Business Rule, and Scheduled Jobs, but I couldn't find where to disable it. Does anyone know the name of the Business Rule, Alert Management Rule, or Scheduled Job? Also, in that Scheduled Job, which Script Include is being used?

[GlideFather]

This is out-of-the-box, what you ask for is customisation, there is nothing to find. It is something to be developed :))

[GaneshSuresh]

@SathishB -   @GlideFather Pointed you to the correct BR. This is OOTB. Unless if you want to apply this at global level, you can control this from Event Management Properties. But, that will be applicable for all severity alerts.

[AJ-TechTrek]

HI @SathishB ,

Please check the Event Management Properties, their is a property which is used to resolve incident if your alert is closed due to Ok severity Event.

evt_mgmt.alert_closes_incident: Determines if closing an alert will resolve an incident, close it, or do nothing.

 

Please appreciate the efforts of community contributors by marking appropriate response as Mark my Answer Helpful or Accept Solution this may help other community users to follow correct solution in future.
 
Thank You
AJ - TechTrek with AJ
LinkedIn:- https://www.linkedin.com/in/ajay-kumar-66a91385/
YouTube:- https://www.youtube.com/@learnitomwithaj
ServiceNow Community MVP 2025