When an alarm from UIM is auto created into an Incident in ServiceNow from the sdgtw probe it starts with a "New" Status. I have that working properly. We also have the probe setup that if the alarm clears it will be auto marked resolved.
Is it possible to setup a rule so that if the status of an existing incident is moved from "new" and set to one of the other status like "Active" or "Awaiting Information" that it would not update the incident and resolve it if the alarm clears? That way when our service desk is doing an investigation or is in the middle of acting on an alarm/incident that even if it clears they can still update there notes and close the incident on there own.
In this example if the incident was created with a "new" status and the status was still "new" then we would like the incident to be resolved if the alarm clears automatically.
------------------------------
IT Administrator
------------------------------