The New Incident Information Events are of Class = CI_INCIDENT_INFO. I couldn't find out, where they are created... there is no rule creating such Events...
Could it be, that TrueSight creating them, because the ITSM Incident get closed/cancelled? But the main Event is still open?
Thanks for help...
Not sure, but we got HotfixCore_11.3.01.000.001 from BMC for this issue. It replaces these files:
I've just installed it today.. if it help I will update this question..