Alert Incident Field Clearing when an info severity event is received after a clear eventIssue When an info event is received after an alert is closed, the alert is re-opened. The incident field is cleared. Why the incident field is cleared? Initial: After Reopen: CauseThe behavior of what happen after reopen alert control by Script Include: EvtMgmtAlertManagementAlertReopenHandler https://<INSTANCE>.service-now.com/nav_to.do?uri=sys_script_include.do?sys_id=e5159ef1534013007f9bddeeff7b120c ResolutionIn order to keep the incident after reopen, it need to be either a) the incident was created manually or b) match the alert management rule Snippet of the code: handleReopen: function(current, alertNumber, manualIncidentByUserID, taskNumber, task) { // if alert rules are matched or the incedent was created manually, // Reopen incident var amExecutionGR = this.getAlertManagementExecutionByAlert(current); if (this.isManualExecution(manualIncidentByUserID,amExecutionGR)) { this.reopen(current, taskNumber, task); } else { var ruleMatched = this.alertMatchеsAlertManagementRules(current, amExecutionGR); if (ruleMatched) { this.reopen(current, taskNumber, task); } else { // no matched rule, and incident was created by Job, // the incident should not be reopened this.addWorkNoteAndClearTaskIfNeed(current, taskNumber); } } } For point b), check the alert management rule that create the incident. If the reopen of alert is not matched with the alert management rule -> Alert filter section, the 'incident' field will be cleared. ie: If want to keep the incident field as it is, workaround is setting the system property evt_mgmt.always_reopen_incident to 'true'.