We have our ServiceNow instance integrated in the Orion platform and have various alerts which create automatic Incidents as per the alert configuration.
I have a few complaints from colleagues regarding alerts that create incident based on Volume or Disk Usage approaching their limits.
Their complaint is that when they expand the disk on the Server, Orion can take up to 10 or 15 minutes to poll the Server and recognize the change and therefore "resolve" or "close" the ticket.
So they manually try to mark the INC resolved in ServiceNow, but of course as the alert is still active, Orion re-opens the ticket.
Is there a way to allow Orion to close off the active alert based on marking the ticket resolved in ServiceNow? This would entail rather than a one-way sync of the alert status, but a two way sync of sorts.
(I have tried playing with the re-open settings like never re-open but this creates another problem in that, if the alert re-triggers a few days again, it will not re-open the ticket if the ticket is not effectively closed. In our ServiceNow instance, INCs are marked resolved for multiple days before actually moving to the closed status).