How to prevent auto-resolving Major Incidents when alert closes?

[lvenna]

Hi Community,

We are using ServiceNow Event Management where incidents are created from alerts.

We have the following requirement related to Major Incidents:
• When an incident is accepted as a Major Incident (using major_incident_state on the Incident table), it should not be automatically resolved or closed when the related Alert state changes to Closed.
• The Major Incident must be reviewed and resolved manually.
• If the same alert reopens / bounces back:
• Do nothing if the related Major Incident is still open
• Create a new incident only if the previous Major Incident is already Resolved or Closed

Can you please help me, what is the recommended and supported approach to implement this behavior?

Thank you,

Laxma.

[Ankur Bawiskar]

@lvenna 

did you identify which OOTB component is auto-resolving?

if you don't want then disable that

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[lvenna]

@Ankur Bawiskar 

Hello,

Thank you for the response. I have not found any OOB rule which is resolving the incidents based on Alert state. 

Laxma.