Create an incident based on multiple alerts

[Ronnie]

Hello,

Suppose that in my team we get alerts that look like this:

=======

Alert:

User has encountered a problem in prod env.

User: sampleuser

=======

I would like to automatically create an incident based on alerts from at least 3 different users.

How can I achieve such a behavior?

[Tom Russell · Accepted solution]

@ronyut if you have a plan that includes use of an OEC (Opsgenie Edge Connector) this shouldn't be too hard:

Have these alerts trigger an OEC script that searches for other, similar open alerts. Collect the users and do a sort -unique to see how many different users have had alerts generated. If the count is 3 or more, create an incident.

You could create the incident via the API, directly from the OEC script, but I don't believe you can currently associate alerts to an incident via the API. One way to get around this would be to just set a unique tag on one of the alerts, then add an incident creation rule that looks for that tag and creates the incident from that alert.