We have an automation rule to create an incident when an alert is created with specific tags, however when the alert is closed, the incident remains open. I have not identified a method to address this issue, aside from establishing another automation rule to facilitate the closure of the incident.
We prefer not to use Sync, as it does not include the essential fields required for our incident management process.
Regarding the closure behavior, I am having trouble creating an automation rule to close the incident when the alert is closed. The only reference to the incident within the alert is found in the linked issues under 'escalated by,' but I do not see the option in the automation rule configuration to access this information for correlating the closure behavior.
It seems logical that the automatic closure of the incident when the associated alert is closed should be a straightforward feature. What am I overlooking in this process?
