Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Create an incident based on multiple alerts

Ronnie July 6, 2023

Hello,

 

Suppose that in my team we get alerts that look like this:

=======

Alert:

User has encountered a problem in prod env.

User: sampleuser

=======

 

I would like to automatically create an incident based on alerts from at least 3 different users.

How can I achieve such a behavior?

1 answer

1 accepted

0 votes
Answer accepted
Tom Russell
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
July 6, 2023

@ronyut if you have a plan that includes use of an OEC (Opsgenie Edge Connector) this shouldn't be too hard:

Have these alerts trigger an OEC script that searches for other, similar open alerts. Collect the users and do a sort -unique to see how many different users have had alerts generated. If the count is 3 or more, create an incident.

You could create the incident via the API, directly from the OEC script, but I don't believe you can currently associate alerts to an incident via the API. One way to get around this would be to just set a unique tag on one of the alerts, then add an incident creation rule that looks for that tag and creates the incident from that alert.

Suggest an answer

Log in or Sign up to answer
DEPLOYMENT TYPE
CLOUD
TAGS
AUG Leaders

Atlassian Community Events