Option to create new alert when the associated incident is closed

[arunmanohar]

Current Setup

1. Event creates an Alert.
2. Alert creates an Incident and Case.
3. We use the OOB active interval (evt_mgmt.active_interval) of 4 hours.
4. If the same event reoccurs:
   • After 4 hours → a new alert is created.
   • Within 4 hours → the existing alert is reopened/updated

Problem Scenario

Time Action

10:01	Alert created
10:02	Incident and Case created
10:05	Agent manually closes the Case and Incident
10:10	Same event reoccurs

Since the event reoccurs within the 4-hour active interval, ServiceNow reopens/updates the existing alert.

However, the associated incident is already Closed. In our implementation, closed incidents cannot be moved back to WIP/Open.

As a result:

• The alert gets updated/reopened.
• since the incident remains closed - Only a work note is added to the closed incident

Requirement

When an event reoccurs within the active interval, we want the platform to check whether the incident associated with the alert is closed.

If the associated incident is closed, instead of reopening/updating the existing alert, we would like to:

1. Create a new alert.
2. Create a new incident and case from that alert.
3. Continue normal processing for the newly created records.