diff --git a/app/models/channel/filter/monitoring_base.rb b/app/models/channel/filter/monitoring_base.rb
index a96bbb86e..a870df71e 100644
--- a/app/models/channel/filter/monitoring_base.rb
+++ b/app/models/channel/filter/monitoring_base.rb
@@ -45,6 +45,13 @@ class Channel::Filter::MonitoringBase
     # check min. params
     return if result['host'].blank?
 
+    # get state from body
+    if result['state'].blank?
+      if mail[:body] =~ /==>.*\sis\s(.+?)\!\s+?<==/
+        result['state'] = $1
+      end
+    end
+
     # check if ticket with host is open
     customer = User.lookup(id: session_user_id)
 
diff --git a/test/unit/integration_icinga_test.rb b/test/unit/integration_icinga_test.rb
index 2798189a8..7a765414d 100644
--- a/test/unit/integration_icinga_test.rb
+++ b/test/unit/integration_icinga_test.rb
@@ -75,7 +75,7 @@ IPv4:    127.0.0.1="
     assert_equal('apn4711.dc.example.com (Display Name: "apn4711.dc.example.com")', ticket_0.preferences['icinga']['host'])
     assert_equal('CHECK_RBL CRITICAL - apn4711.dc.example.com BLACKLISTED on 1 server of 38 (ix.dnsbl.example.com)', ticket_0.preferences['icinga']['info'])
     assert_equal('RBL check (Display Name: "RBL check")', ticket_0.preferences['icinga']['service'])
-    assert_nil(ticket_0.preferences['icinga']['state'])
+    assert_equal('CRITICAL', ticket_0.preferences['icinga']['state'])
 
     # RBL check II
     email_raw_string = "To: support@example.com
@@ -108,9 +108,42 @@ IPv4:    127.0.0.1="
     assert_equal('apn4711.dc.example.com (Display Name: "apn4711.dc.example.com")', ticket_0_1.preferences['icinga']['host'])
     assert_equal('CHECK_RBL CRITICAL - apn4711.dc.example.com BLACKLISTED on 1 server of 38 (ix.dnsbl.example.com)', ticket_0_1.preferences['icinga']['info'])
     assert_equal('RBL check (Display Name: "RBL check")', ticket_0_1.preferences['icinga']['service'])
-    assert_nil(ticket_0_1.preferences['icinga']['state'])
+    assert_equal('CRITICAL', ticket_0_1.preferences['icinga']['state'])
     assert_equal(ticket_0_1.id, ticket_0.id)
 
+    email_raw_string = "To: support@example.com
+Subject: [PROBLEM] RBL check on apn4711.dc.example.com is OK!
+User-Agent: Heirloom mailx 12.5 7/5/10
+MIME-Version: 1.0
+Content-Type: text/plain; charset=us-ascii
+Content-Transfer-Encoding: quoted-printable
+Message-Id: <20160131094621.29ECD400F29C-icinga-1-2@monitoring.znuny.com>
+From: icinga@monitoring.example.com (icinga)
+
+***** Icinga 2 Service Monitoring on apn4711.dc.example.com *****
+
+=3D=3D> RBL check on apn4711.dc.example.com is OK! <=3D=3D
+
+Info:    CHECK_RBL OK - apn4711.dc.example.com BLACKLISTED on 1 server of=
+ 38 (ix.dnsbl.example.com)=20
+
+When:    2017-08-06 22:18:43 +0200
+Service: RBL check (Display Name: \"RBL check\")
+Host:    apn4711.dc.example.com (Display Name: \"apn4711.dc.example.com\")
+IPv4:    127.0.0.1="
+
+    ticket_0_2, article_p, user_p, mail = Channel::EmailParser.new.process({}, email_raw_string)
+    assert_equal('closed', ticket_0_2.state.name)
+    assert(ticket_0_2.preferences)
+    assert(ticket_0_2.preferences['integration'])
+    assert_equal('icinga', ticket_0_2.preferences['integration'])
+    assert(ticket_0_2.preferences['icinga'])
+    assert_equal('apn4711.dc.example.com (Display Name: "apn4711.dc.example.com")', ticket_0_2.preferences['icinga']['host'])
+    assert_equal('CHECK_RBL CRITICAL - apn4711.dc.example.com BLACKLISTED on 1 server of 38 (ix.dnsbl.example.com)', ticket_0_2.preferences['icinga']['info'])
+    assert_equal('RBL check (Display Name: "RBL check")', ticket_0_2.preferences['icinga']['service'])
+    assert_equal('CRITICAL', ticket_0_2.preferences['icinga']['state'])
+    assert_equal(ticket_0_2.id, ticket_0.id)
+
     # matching sender - CPU Load/host.internal.loc
     email_raw_string = "To: support@example.com
 Subject: PROBLEM - host.internal.loc - CPU Load is WARNING