Service now auto closing incidents when using the Mirrored XSOAR Ticket custom close state code parameter

Packs/ServiceNow/Integrations/ServiceNowv2/ServiceNowv2.py

@@ -2471,17 +2471,18 @@ def get_remote_data_command(client: Client, args: Dict[str, Any], params: Dict)
     # Handle closing ticket/incident in XSOAR
     close_incident = params.get('close_incident')
     if close_incident != 'None':
-        server_close_custom_state = params.get('server_close_custom_state')
-
-        if server_close_custom_state or (ticket.get('closed_at') and close_incident == 'closed') \
+        server_close_custom_state = params.get('server_close_custom_state', '')
+        ticket_state = ticket.get('state', '')
+        if (ticket_state and ticket_state in server_close_custom_state) \
+            or (ticket.get('closed_at') and close_incident == 'closed') \
                 or (ticket.get('resolved_at') and close_incident == 'resolved'):
             demisto.debug(f'SNOW ticket changed state- should be closed in XSOAR: {ticket}')
             entries.append({
                 'Type': EntryType.NOTE,
                 'Contents': {
                     'dbotIncidentClose': True,
                     'closeNotes': ticket.get("close_notes"),
-                    'closeReason': converts_state_close_reason(ticket.get("state"), server_close_custom_state)
+                    'closeReason': converts_state_close_reason(ticket_state, server_close_custom_state)
                 },
                 'ContentsFormat': EntryFormat.JSON
             })

Packs/ServiceNow/Integrations/ServiceNowv2/ServiceNowv2_test.py

@@ -1352,6 +1352,37 @@ def test_get_remote_data_closing_incident(mocker, response_closing_ticket_mirror
     assert closing_response == res[2]['Contents']
 
 
+def test_get_remote_data_closing_incident_with_different_closing_state(mocker):
+    """
+    Given:
+        -  ServiceNow client
+        -  arguments: id and LastUpdate(set to lower then the modification time).
+        -  ServiceNow ticket in closed state
+        -  close_incident parameter is set to closed
+        - server_close_custom_state parameter differs from the ticket's closing state
+    When
+        - running get_remote_data_command.
+    Then
+        - Validate that the incident does not get closed
+    """
+
+    client = Client(server_url='https://server_url.com/', sc_server_url='sc_server_url',
+                    cr_server_url="cr_server_url", username='username',
+                    password='password', verify=False, fetch_time='fetch_time',
+                    sysparm_query='sysparm_query', sysparm_limit=10, timestamp_field='opened_at',
+                    ticket_type='sc_task', get_attachments=False, incident_name='description')
+
+    args = {'id': 'sys_id', 'lastUpdate': 0}
+    params = {'close_incident': 'closed', 'server_close_custom_state': '6=Design'}
+    mocker.patch.object(client, 'get', return_value=RESPONSE_CLOSING_TICKET_MIRROR_CUSTOM)
+    mocker.patch.object(client, 'get_ticket_attachment_entries', return_value=[])
+    mocker.patch.object(client, 'query', return_value=MIRROR_COMMENTS_RESPONSE)
+    res = get_remote_data_command(client, args, params)
+    assert len(res) == 2
+    # This means that the entry is of type Note, which does not indicate the closing of the incident
+    assert res[1].get('Note', False) is True
+
+
 def test_get_remote_data_no_attachment(mocker):
     """
     Given:

Packs/ServiceNow/ReleaseNotes/2_5_26.md

@@ -0,0 +1,7 @@
+
+#### Integrations
+
+##### ServiceNow v2
+
+- Fixed an issue where incidents would auto close after using the *Mirrored XSOAR Ticket custom close state code* parameter.
+- Updated the Docker image to: *demisto/python3:3.10.11.61265*.

Packs/ServiceNow/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "ServiceNow",
     "description": "Use The ServiceNow IT Service Management (ITSM) solution to modernize the way you manage and deliver services to your users.",
     "support": "xsoar",
-    "currentVersion": "2.5.25",
+    "currentVersion": "2.5.26",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",