Backstory:
My company currently has an on-call setup with ServiceNow where if there is an incident about a device that is a firewall, router, switch or AP, someone in the NOC will receive a call if that device goes down. Previously, we used an email intake rule with ServiceNow that would take email alerts from SolarWinds and generate an incident.
The way our on-call business rule works is that if the ServiceNow incident is assigned to the NOC team and the "assigned to" field is empty, it will trigger a call. Which is how the system would work. An access point would go down, and an incident would be created in ServiceNow assigned to the NOC, and a NOC team member would get called, we would accept the call and the ticket would be assigned to whoever in the NOC accepted it.
This worked well when we were using the email intake rule. If a device went down and then went back up, we would manually set the incident to "resolved". If that same device went down again, a new incident would be created, and the NOC would get called again.
We saw that there was an auto-resolve feature with the SolarWinds/ServiceNow API and were interested in enabling it, so we did.
The issue:
The API resolves an incident when noticing that a device has come back up and the alert has been reset. When the device goes down again that same incident is reopened again, keeping whoever was assigned to the incident. Our on-call will not trigger since someone is already assigned to the incident.
Does anyone have a solution for this?
