We've established our integration with ServiceNow for automatic incident creation/update. What we're trying to understand is if we need to update our procedures or how to handle resolving the incidents.
Let's say we have a high CPU utilization. SolarWinds alert is created which then creates a ServiceNow incident. The tech receives the incident, fixes the CPU issue, then resolves the incident. The incident is then re-opening because the SolarWinds alert is still active, but we'd like the incident to remain resolved.
- Does the agent have to go clear the alert manually (presumably before resolving the ServiceNow incident)?
- Is there a way to have ServiceNow clear the alert when the agent resolves the incident? (ServiceNow does acknowledge the alert, so it's already pushing information to SW)
- Is there a way to modify the integration so upon resolving the incident, ServiceNow doesn't immediately check for the alert status, but instead could wait 30 minutes so SW has time to conduct its next poll?
