Incident creation based on alert count

Urban Jurca

Hi team,

 

we are trying to come up with an automated incident creation rule that fires based on alert count (grouped by tags?).

In a perfect world this is something we would like to achieve:

- we have an internal DB service

- all alerts related to the DB service are tagged by service: DB service

- we would like to automatically open an incident if we have e.g. 3 open alerts where tag == DB service; or an alert with tag == DB service has a P1 priority.

 

Automatic incident creation based on priority works fine, but any more elaborate rules are not natively available. How do you solve this challanges?

Best,

U

Volkan_osb77j

Hi Urban,

I assume you do not have any issues with setting up your service rules based on the alert priority or tags for automated incident creation but the issue you'd like to overcome is to have Opsgenie trigger a new incident based on the count of the associated alert.

The automated incident creation based on the alert count is unfortunately not one of the default options you can configure within your services. However, any custom solution that could be implemented through Opsgenie REST API or Webhook may be a workaround for you here in this case.

If you possibly choose to develop a custom script that counts the alerts having a specific tag, it will be possible for this script to create a new incident through Incident API. It is also doable in your custom solution to get the alert deduplication count via Opsgenie API or Webhook/OEC integrations. An outgoing webhook request can be sent to a URL you will provide in Webhook integration settings when there is a new alert with a specific tag like "DB Service". Please note that the outgoing integrations like Webhook integration are only available in Standard and Enterprise plans.

On the other hand, we also have raised a feature request to our product team to make this feature available natively as there are some other Opsgenie users requested the same before.The whole incident management concept is getting more advanced with the new feature sets and this might be one of the enhancements that may be delivered in the future. I will update our internal feature request with this community post to get our product team's attention on this one and I hope they will be making an analysis for this in one of our future development sprints!

Hope this helps!