Close a Security Incident in ServiceNow

To close a Security Incident in ServiceNow, perform the following procedure.

Procedure

1. Log in to your ServiceNow instance.
2. Go to Security Incident > Show All Incidents.
3. Select the Incident to close.
4. Set the State field to Recover.
5. Right-click the Security Incident taskbar and click Save.
6. Set the State field to Closed.
7. In Close Information, provide the close code and close note.
8. Right-click the Security Incident taskbar and click Save.
   If there are open alerts associated with the Incident, a consent form displays.
9. Select the alerts to close together with the Incident.

   

10. To close the ITSM incident and selected alerts, click Resolve.