Incident Auto Closures

The Incident Auto Closer feature enables the automatic closure of incidents that have not been scanned or updated within a defined time period. You must configure a closure condition, and once an incident meets this condition, its state is automatically updated to Closed.

You can define multiple Auto-Closure Rules according to the requirements.

This feature is off by default and must be enabled manually. See Step 3 for setting the auto-closure condition. 

Close Stale Incidents

You can set the following configurable conditions to close stale incidents automatically:

Condition	Description
Detection Last Found	During the synchronization of detection data from Qualys to ServiceNow, if the incident creation date exceeds a specified number of days from the last detection date, the incident will be automatically closed.
Asset Last Scanned Date	If the asset's last scanned date retrieved from Qualys during the ServiceNow sync is earlier than the configured date, the associated incident will be closed automatically.
Asset Last Updated Date	If the asset's last updated date of the Host Asset record retrieved from Qualys during the ServiceNow sync is earlier than the configured date, the associated incident will be closed automatically.

How to Set an Incident Auto Closure Condition for Stale Incidents

To set the Incident Auto Closure condition for stale incidents, perform the following steps:

1. Navigate to Qualys Core and select Incident Auto Closures.
2. To set a new condition, click New.
   
   The Incident Auto Closure setting page is displayed.
3. To set the condition, add the following details:
   1. Enter Name for the incident closure.
   2. Select the Active checkbox to enable the triggering condition.
   3. From the Run dropdown, choose a frequency to trigger the auto closure according to the condition. 

      The auto closure condition is set to run daily by default.

      • Daily: Select this option to trigger the automatic closure of incidents daily at a specified time. 
      • Weekly: Select this option to trigger the auto closure on a specific day(s) of the week. 
      • Monthly: Select this option to trigger the auto closure on the date of the month or day of the week.
      • Periodically: Select this option to trigger the auto closure after a specific period (number of days).
      • Once: Select this option to trigger the auto closure only once on the specified date and time.
      • On Demand: Select this option to trigger the auto closure on demand.
      • Business Calendar: Entry Start: Select this option to trigger the auto closure on the business calendar start date and time.
      • Business Calendar: Entry End: Select this option to trigger the auto closure on the business calendar end date and time.
4. Navigate to the Close Stale Incidents tab.
   
5. From the Incident Auto Closure Condition dropdown, choose a condition to auto-close the incidents.
6. In the Last found (days ago) field, enter the number of days and click Submit.

If the incident’s detection last found date, the asset’s last scanned date, or the last updated date is older than the specified number of days, the incident is automatically transitioned to the Closed state based on Incident Auto-Closure Condition.

Close Incident based on CI Lifecycle

If the incident's related Configuration Item (CI) is in the Retired state and the relevant auto-closure checkbox is selected, all associated incidents are automatically closed based on the CI's lifecycle status.

How to Set an Incident Auto Closure Condition based on CI Life Cycle

To set a condition for closing incidents based on the CI life cycle, perform the following steps:

1. Perform Steps 1 to 3 mentioned for closing stale incidents.
2. Navigate to the Close Incidents based on CI Life Cycle tab.
   
3. Select the Auto Close Incident for Retired CI checkbox and click Submit.

The incidents related to the retired CIs get automatically closed.