Incident Rules

[Erica Dohring]

Do Incident rules work if a rule is matched once the alert has been edited?

Say Team-A has an incident rule to create an incident if responder "Team-A" has been added to an alert (contains). I've noticed the incident rules seem to work if the alert was created with Team-A as a responder, but an incident is not created if Team-A is added to the alert after the creation of the incident. Is this desired behavior? In other words, is the behavior I list below supported?

Scenario:

Example - alert comes in, has responder "Person-1".

Person-1 traiges it, realizes they should add responder "Team-A" to help. 

Ideal:

Incident is created per Team-A's rules

Actual:

No incident is created

[John M]

Hi @Erica Dohring

Incident rules are only processed at alert creation, but not again when changes are made to alerts, so a team's incident rule would not trigger if that team was added manually after the alert was created. In that situation, the user would need to create an incident from the alert and add the correct team to the incident.