Disable the "Auto-matched Alert Behavior"

[Luis Helder]

I was reading through https://support.atlassian.com/opsgenie/docs/automatically-create-an-incident-via-incident-rules/ and it states the following:

After an incident is opened, alerts matching the Incident Rules become Associated Alerts under the incident automatically, and no notification is sent. This aims to reduce alert fatigue.

Is there a way to disable this behavior, so it actually creates incidents for all alerts matching the rules?

If not, am I going against the expected use of the tool?

I'm not sure what is the common use case regarding incidents in Opsgenie. Should I mostly create them manually, and try to automate only in specific cases using more specific incident-rules?

[John M · Accepted solution]

Hi Luis,

Incidents are usually managed a bit more manually since they are designed to be much less common and more urgent than alerts. 

The idea with incident rules only allowing for one open incident at a time that matches the rule is that, when an incident is created for a specific rule, alerts will often keep coming in that are related to the same incident until it is resolved. If the system created a new incident per alert, that could result in many incidents all related to the same issue. Incidents also have to be closed manually so it could create a lot of extra manual work. 

There is no way to override this feature. The 2 things I would recommend are:

1. Use specific criteria in each incident rule so that new alerts only match open incidents are relevant

2. Close incidents in a timely manner. This will ensure that a new incident is created if the previously created incident matching the same rule has been resolved