Hi @MattCD ,
Lets discuss Why this happens (expected behavior):
This is actually a known behavior of the default Alert Playbook:
* The playbook shows task-level orchestration progress separately from the alert state.
* Closing the alert (manually or via automation) does not automatically close or mark the playbook as complete.
* If a flow runs and finishes, the Alert Remediation task status may not update to “Complete” because:
* The OOB playbook flow uses subflows and steps that don’t always trigger the update of the top-level playbook status.
* Playbook task state is stored independently in the PA Playbook tables (pa_task, pa_activity, etc.) and relies on explicit updates.
In short:
* Playbook shows “In Progress” because the internal flow activity/task was never marked as completed.
* This is not automatically tied to alert closure.
Is this documented?
ServiceNow documentation mentions this indirectly:
* Playbook task completion depends on completion of all activities in the playbook.
* If the flow execution ends without explicitly calling a “Complete Task” action (like Flow | Mark Task Complete), the playbook remains “In Progress”.
You can find this in:
* ServiceNow Docs: Automate remediation with alert playbooks
* Community posts where customers note the same experience.
Solution / recommended approach:
1. Validate your remediation flow
Check the remediation flow that runs from the alert:
* Does it explicitly call an action to mark the playbook task complete?
* Use: Flow Logic → Complete Task or call pa_task.updateState('complete').
If missing, add this as the last step.
2. Update playbook logic
* You can customize the OOB playbook to:
* Check alert state
* If alert is closed → mark the remediation task complete.
* This keeps the visual playbook in sync.
3. Cleanup older playbooks
For old alerts that already closed but show playbook “In Progress”:
* Use a fix script or scheduled job to close pa_task items where:
* Related alert is closed
* Playbook task is still “In Progress”
4. Understand separation
* Playbook status ≠ alert status.
* Alert closure is driven by Event Management or operator.
* Playbook state is driven by task workflow.
5. Why this matters:
If you rely on the playbook dashboard or reports, having “In Progress” forever causes:
* Wrong numbers in operational dashboards.
* Difficulty in SLA tracking.
Adding explicit task completion in the remediation flow fixes this.
Please appreciate the efforts of community contributors by marking appropriate response as Mark my Answer Helpful or Accept Solution this may help other community users to follow correct solution in future.
Thank You
AJ - TechTrek with AJ
LinkedIn:- https://www.linkedin.com/in/ajay-kumar-66a91385/
YouTube:- https://www.youtube.com/@learnitomwithaj
ServiceNow Community MVP 2025
