After closing Parent & Child incidents manually, the child incidents are getting reopened in SIR

[Susmitha1625]

Hi People,

Please help me, we are facing a weird problem in Security Incidents Response.

We have parent and child incidents. After closing the Parent Incident, we had to close the child incident manually, it's not auto-closing the child incidents. I don't know if this is an expected behavior in SIR. And, above that, the child incidents are getting re-opened after manually closing them. Kindly help me towards the resolution. Your input is really appreciated. Thanks in Advance. 

[PaulSylo]

Hello Susmitha - Looks like this is an Expected behavior in SIR, as child ticket has their own requirement and many cases may not comply with a parent. so logic is correct. but for reopening, looks like some BR or Workflow reopening this. If a workflow rule is reopening the incidents, you can disable the workflow rule or modify it to prevent the incidents from being reopened. If a business rule is reopening the incidents, you can disable the business rule or modify it to prevent the incidents from being reopened.

in case you want to make this child SIR to close, See this link - you may get some direction,

https://www.servicenow.com/community/secops-vr-forum/child-security-incidents-not-auto-closing-whene...

https://www.servicenow.com/community/itsm-forum/child-incidents-are-not-closing-with-parent-incident...

[Dr Atul G- LNG]

Hi @Susmitha1625 

Agree with @PaulSylo . During my SIR prep, i also noticed this but did not find why?