Close Incident
The users of a user group, who have permission to close an incident based on the incident severity and type, can close an incident. Administrators can define the user groups that can close an incident under Admin Panel > Configurations > Incidents > Incidents Closure. For more information, see the Incidents Closure section in Configure Incident Settings.
You can close an incident if the incident meets the following conditions:
All mandatory fields of each phase of the incident are updated with relevant details.
All associated actions are closed.
All associated PIRs are closed.
Note
Administrators can configure if an incident can be closed without closing the associated actions and PIRs. For more information, see the Incidents Closure section in Configure Incident Settings.
To close an incident, follow these steps:
On the top-right corner of an incident, click the Open status and select Close.
Enter an incident closure note.
To close all the associated actions and PIRs, select close all actions and PIRs associated with the Incident. This option is available only if No Condition is selected in Admin Panel > Configurations > Incidents > Incidents Closure > Action and PIR status.
Note
This option is only available in the New Layout for incident response, from Respond v3.4.3 onwards.
Click Yes, Proceed.
The incident is closed and the resolution SLA and cost tracking of the incident stops.
Note
When you close an incident, all the merged incidents are automatically closed. Also, the closure comment and closure note data of the parent incident are added to the child incidents automatically. This ensures the closure of child incidents with relevant comments and notes.
You can reopen the incident within the time limit configured by the administrator. CFTR does not include the time between incident closure and incident reopening to calculate the SLA and cost. For more information, see the Incidents Reopen section in Configure Incident Settings.
Note
When you reopen an incident, the incident creation date does not change. Since some dashboard widgets use the incident creation dates, reopening an incident affects the dashboard viewing experience when you select a wide date range.