Bypass or update logic to clear alert (LogicMonitor to ServiceNow Integration)

Hmm, atleast for me, I don't consider an issue to be resolved unless the alert has also cleared. In my experience it leads to orphan alerts where the engineer thought they fixed the issue but didn't, or they disagree with the alert level. Then when something gets worse management find out that we had an alert for a month that was missed. If the alert threshold needs tuning, then that should be part of the ticket too.

I also wouldn't let LM resolve an alert ticket itself. There can be alerts that "flap" where it causes an alert but then clears in a few minutes. This may lead to getting frequently alerts that open then auto-close tickets and no one notices a device has been unstable for days.

Instead I would suggest that clearing in LM just adds a note to the ticket that it has cleared but the engineer would review it to confirm it's really resolved. I haven't really touched the SN integration much but I assume you can modify the biz rules or javascript code to check ticket status. LM itself is very simple in that it just sends the state change without any logic, you likely need to do that in SN itself, which has more flexibility from my understanding.