diff --git a/app/models/channel/filter/monitoring_base.rb b/app/models/channel/filter/monitoring_base.rb
index 565ef90c0..eade38c80 100644
--- a/app/models/channel/filter/monitoring_base.rb
+++ b/app/models/channel/filter/monitoring_base.rb
@@ -53,6 +53,13 @@ class Channel::Filter::MonitoringBase
       end
     end
 
+    # get state from subject
+    if result['state'].blank?
+      if mail[:subject] =~ /on\s.+?\sis\s(.+?)\!/
+        result['state'] = $1
+      end
+    end
+
     # check if ticket with host is open
     customer = User.lookup(id: session_user_id)
 
@@ -73,6 +80,7 @@ class Channel::Filter::MonitoringBase
 
       # check if service is recovered
       if auto_close && result['state'].present? && result['state'].match(/#{state_recovery_match}/i)
+        Rails.logger.info "MonitoringBase.#{integration} set autoclose to state_id #{auto_close_state_id}"
         state = Ticket::State.lookup(id: auto_close_state_id)
         if state
           mail[ 'x-zammad-ticket-followup-state'.to_sym ] = state.name
diff --git a/test/unit/integration_icinga_test.rb b/test/unit/integration_icinga_test.rb
index 2a32377ef..e5c6b8052 100644
--- a/test/unit/integration_icinga_test.rb
+++ b/test/unit/integration_icinga_test.rb
@@ -313,6 +313,56 @@ Comment: [] =
     assert_equal('apn4711.dc.example.com', ticket_3.preferences['icinga']['host'])
     assert_nil(ticket_3_1.preferences['icinga']['service'])
     assert_equal('DOWN', ticket_3_1.preferences['icinga']['state'])
+
+    # ping down
+    email_raw_string = "To: support@example.com
+Subject: [PROBLEM] Ping IPv4 on apn4711.dc.example.com is WARNING!
+From: icinga2@monitoring.example.com (icinga)
+
+***** Service Monitoring on monitoring.znuny.com *****
+
+Ping IPv4 on apn4711.dc.example.com is WARNING!
+
+Info:    PING WARNING - Packet loss =3D 0%, RTA =3D 160.57 ms
+
+When:    2017-09-28 09:41:03 +0200
+Service: Ping IPv4
+Host:    apn4711.dc.example.com
+IPv4:    127.0.0.1="
+
+    ticket_4, article_p, user_p, mail = Channel::EmailParser.new.process({}, email_raw_string)
+    assert_equal('new', ticket_4.state.name)
+    assert(ticket_4.preferences)
+    assert(ticket_4.preferences['icinga'])
+    assert_equal('apn4711.dc.example.com', ticket_4.preferences['icinga']['host'])
+    assert_equal('Ping IPv4', ticket_4.preferences['icinga']['service'])
+    assert_equal('WARNING', ticket_4.preferences['icinga']['state'])
+    assert_not_equal(ticket_4.id, ticket_1.id)
+
+    # ping up
+    email_raw_string = "To: support@example.com
+Subject: [RECOVERY] Ping IPv4 on apn4711.dc.example.com is OK!
+From: icinga2@monitoring.example.com (icinga)
+
+***** Service Monitoring on monitoring.znuny.com *****
+
+Ping IPv4 on apn4711.dc.example.com is OK!
+
+Info:    PING OK - Packet loss =3D 0%, RTA =3D 20.23 ms
+
+When:    2017-09-28 11:42:01 +0200
+Service: Ping IPv4
+Host:    apn4711.dc.example.com
+IPv4:    127.0.0.1="
+
+    ticket_4_1, article_p, user_p, mail = Channel::EmailParser.new.process({}, email_raw_string)
+    assert_equal(ticket_4.id, ticket_4_1.id)
+    assert_equal('closed', ticket_4_1.state.name)
+    assert(ticket_4_1.preferences)
+    assert(ticket_4_1.preferences['icinga'])
+    assert_equal('apn4711.dc.example.com', ticket_4.preferences['icinga']['host'])
+    assert_equal('Ping IPv4', ticket_4.preferences['icinga']['service'])
+    assert_equal('WARNING', ticket_4_1.preferences['icinga']['state'])
   end
 
   test 'not matching sender tests' do