In general, once an incident is closed/ended, it should not be reopened. However, we have run into situations where we have to reopen a previously ENDed incident. Right now, source systems can not do this. However, this limitation seems arbitrary, and for us it would make a lot of sense if source systems would be allowed to do this, because it could otherwise lead to inconsistent state between our Correlator and Argus...

What are the current considerations for disallowing source systems to REOpen incidents? Would it be possible to allow source systems this functionality?