Alerts in the "Reopen" status are closed by automation Summary Alerts in the "Reopen" status are closed by automation when the event management system properties are set as below. 1. evt_mgmt.incident_closes_alert = yes 2. evt_mgmt.alert_reopens_incident = Nothing When an event is processed it will either open a new alert or reopen an closed alert. When an alert is reopened, if it does not have any associated incident opened then the alert will be closed automatically. With the above mentioned properties it will not open an incident. So this behavior will be expected.Related LinksFrom the documentation, 1. When new additional events are generated which on processing finds existing closed alert then the alert is reopened. An alert can be reopened manually. 2. Reopening of existing closed alert by new events is controlled by property "evt_mgmt.active_interval". 3. By default value of this property is 14400 sec. This means that if an alert is closed and a new event is generated within 4 hours which matches the same message key then the existing alert is reopened. 4. When an alert is reopened, the related incident is processed as follows: a. If the incident is not Resolved or Closed, a work note is added to indicate that the related alert was reopened. b. If the incident is Resolved or Closed, the incident is reopened, a new incident is created, or nothing is done, depending on the evt_mgmt.alert_reopens_incident property value. - If the incident is reopened, work notes are added to the incident. - If a new incident is created, any matching alert management rule, alert action rule, and task template apply to the incident. - If there is no matching alert rule or template, fields from the existing incident are copied to a new incident.5. The business rule that gets executed post alert reopen is "Reopen associated closed incident"6. This BR calls for script include "EvtMgmtAlertManagementAlertReopenHandler" which again invoke the Alert Management process to find the correct rule and perform the remediation action.