Can a policy or alert detect if this event has an open alert and branch from there?

[Russell Johnson]

I want alerts the second time something occurs. 

It seems to me we have de-duplication, so it's there, at the end of the flow. 

When the event count is greater than 1, send the alert. That seems straightforward enough. 

I have the integration set up so it will close an alert if it gets a success after it gets a failure. This works like a champ. 

The latter would be a good bonus. 

[John M · Accepted solution]

Hi @Russell Johnson ,

You can use a team-based notification policy to delay alerts until the deduplication count has reached a certain number. Keep in mind, this will only occur on the alerts where the team is assigned as the 'owner-team' of the alert:

[Russell Johnson]

Thank you for the response. I've configured the settings as stated, and I'm waiting to test them.