Incidents that were Closed, are getting re-opened by Sentinel Integration. This should not happen.

[AbdurRahmanSnow]

Good morning.!
Incidents that are once "Closed", are getting automatically re-opened multiple times, through Sentinel Integration. We need to stop this from happening, because Incidents can only be re-opened, if the Incident's State is "Resolved", and not "Closed". (Also, the Service Account i.e., user profile, used in here just has snc_internal role.)
How can I overcome this issue? I don't know where it is being controlled, as this setup was created 4 years back, and there is no documentation. I checked Business rules, but not sure which one is causing this.)
Should I write a Business rule to overcome this or ACL? It is re-opening the ticket multiple times, if the State is either in "Closed" or "Cancelled" State.
Requirement is: Once State is either "Closed" or "Cancelled", it should not open any ticket, irrespective of whatever the integration type might be. Strict condition should be implemented. The action should be aborted, if any Service Account has admin role too.

Please help. I would be grateful.
@Ankur Bawiskar @Dr Atul G- LNG @Viraj Hudlikar 

[aruncr0122]

Hi @AbdurRahmanSnow ,

This issue happens because the Sentinel integration is updating the Incident record (via API or Scripted REST), which triggers the system to reopen it. Since it was built years ago, the logic might exist in:

Inbound Actions / Scripted REST APIs related to Sentinel

Business Rules (like “Reopen Incident on Update” or “Update from Monitoring Tool”)

Flow Designer / Workflow that reacts to updates

To fix it:

Locate the Source: Check the “Updated by” field or sys_update_name to confirm which integration user is making changes.

Prevent Reopen:

Option 1: Add a Business Rule (before update) on incident table to stop state change if current.state is “Closed” or “Cancelled”.

if (current.state == 7 || current.state == cancelled){ 

    gs.addInfoMessage('Closed/Cancelled incidents cannot be reopened.');

    current.setAbortAction(true);

}

Option 2: If using Flow, add a decision step to skip records in these states.

Option 3: Restrict the integration user’s access (if feasible) to prevent updates on closed tickets.

This ensures incidents stay closed, even if an integration or admin tries to reopen them.

Thanks

[Dr Atul G- LNG]

Hii @AbdurRahmanSnow 

I haven't worked on this specific third-party integration before, but generally, this shouldn't happen.

If it is happening, possible reasons could be that ServiceNow isn't fully consuming the 'close' API, or there may be some business rule running on the integration side. It's better to create the business rule as mentioned by @aruncr0122