Incident and Responder Alert process is not so clear

Question

Dear all,

We are actually evaluating opsgenie and we face to a question related to Incident and Responder alert.

We notice that when an incident is created from incident rules, it does different things :

* Create the incident
* Associate the root alert to the incident
* Create a responder Alert matching the root alert which cause the incident

Now we need at this stage to handle the incident from our team and we do not catch from documentation the correct process .

For instance we understand that the Alert responder is the entry point where people will work on to solve the incident.

So the scenario is as below :

* On personn from our team ACK the reposnder alert
* That person became the owner of the alert
* That person add some notes on his investigation of the incident. During that time the status of the incident is still OPEN
* Then the person decide to close the alert based on the investigation done

Closing the Alert do not close the incident which remains open.

Question 1 :
Does the Responder Alert is the correct working source for the team or does it need to work from incident directly ?

Question 2 :
Is there any sync on Status between incident and Responder Alert. What I means is that if we close the incident, does the Alert is closed automatically or status handling need to be done independently on incident and Alert

Thanks for clarification

serge calderara · Answer

hi @Samir  thanks for your reply

This is not a logical approach that for Incident investigation you need to have a CI/CD.

The resaon for that is that incident does not necessary comes from a software deployement .

From our integration with dynatrace for instance, we would like to start an investigation on the incident which is pure an infrastruture case for which we absolutly do not need any CI/CD.

How this can be done from Incident in that case?

regarsd

Samir · Answer

Hi @serge calderara ,

Yes - there are no notes on incidents, you can add entries to the incident timeline.

And connecting a CI/CD is required for incident investigation, because the incident investigation feature is what allows you to pull in past deployments from your CI/CD tool that could have been a potential cause of the incident.

https://support.atlassian.com/opsgenie/docs/investigate-an-incident/

So without connecting a CI/CD tool, there would be no use of the incident investigation feature.

serge calderara · Answer

Hello @Samir , I notice one strange things if we work on Incident details :

1 - There is not place to add notes ?

2 - We notice a button call INVESTIGATE but it is necessary to connect to a CI/CD why ? There is no way to have an invesigation without CI CD especially if the incident is from a network issue for instance ?

Regards