Hi Srikanth,
All work notes recorded in the parent are propagated to any active children in Activities under the Incident Details tab. When a parent is closed or canceled, any active children are also closed or canceled. Any active Response Tasks on the child incident(s) are canceled. If there are no other open Tasks, the child incident is closed. When closed, the Post Incident Interview records the closure and the information found on the Closure Information tab is propagated from the parent to the children.
https://docs.servicenow.com/csh?topicname=perform-addtl-tasks-on-si.html&version=latest
Also a nice feature, if you install the Security Incident Response Spoke, is the Child Security Incident Automation Playbook. It rolls up the affected users and CIs to the parent security incidents, adds observables from the child incident to the parent security incident, and closes or cancels the child security incident when the parent security incident is closed. You will need to enable this Flow or copy and create your own.
https://docs.servicenow.com/csh?topicname=cj-sir-flow-library4.html&version=latest
- Brad
