Additional events can cause reopening of alerts, or you can reopen an alert by changing its state. When an alert reopens, any associated incidents can also be updated or reopened according to the incident state and the evt_mgmt.alert_reopens_incident property.

Before you begin

Role required: evt_mgmt_admin, evt_mgmt_operator, or evt_mgmt_user

About this task

When an alert is reopened, the related incident is processed as follows:
  • If the incident is not Resolved or Closed, a work note is added to indicate that the related alert was reopened.
  • If the incident is Resolved or Closed, the incident is reopened, a new incident is created, or nothing is done, depending on the evt_mgmt.alert_reopens_incident property value.
    • If the incident is reopened, work notes are added to the incident.
    • If a new incident is created, any matching alert management rule, alert action rule, and task template applies to the incident. If there is no matching alert action rule or template, fields from the existing incident are copied to a new incident.

Procedure

  1. Navigate to All > Event Management > All Alerts.
  2. Search by alert number.
  3. In the State field, click Reopen.
  4. Click Update.