Incident auto-escalation

[Rodrigo Siviero]

Hi,

Is it possible to create auto-escalation based on time to Incidents?

[Connor Eyles]

Hi @Rodrigo Siviero 

Thanks for reaching out :)

Just to understand your use case here, would this be to notify another set of users or "escalate" if the Incident is not resolved in a certain amount of time?

What you can do is setup an escalation policy within the responder team which can be specific for Incident related alerts. When it comes to Incidents, it's not the Incident that actually does the notifying to the responder teams but a "responder alert" which gets generated from the Incident.

How this would work is:

• Incident gets created and has a responder team associated with the Incident.
• A responder alert is created for the responder team to investigate the Incident.
• This responder team will have a routing rule which uses a Incident specific escalation policy.
• On this policy you have have your own rules on who to escalate the alert to and the time frame for the escalation.

How do we set this up:

• Navigate to the responder team and create an escalation policy. You can define the rules how you like, this will be the escalation path for incident related alerts.
• Create a Routing Rule
  • 
  • This will route all alerts with the details key-value of incident-alert-type: Responder. These are the responder alerts generated from Incidents. Ensure to route to the Incident Escalation policy.

Now your responder alerts from incidents will have its own escalation path, I hope this helps!

Thanks,

Connor

[Rodrigo Siviero]

Hi @Connor Eyles thanks, my idea is to really escalate the incidents, not the alerts. If the incident is not closed in 5 minutes, escalates to Team B, if not closed in 15minutes escalates to TeamC.

This workaround still doesn't provide this right? as you will be dealing with alerts with a specific alert-type that is generated with the incident right? I will try to do it but still kind of confuse for me on how to do it.

[Connor Eyles]

Hi @Rodrigo Siviero 

Thank you for providing more information here, I now understand that you are wanting to escalate the incident itself to add another responder to the Incident if it is not closed.

Unfortunately this functionality is not available as this is not how Incident work, however we do have a feature request logged in our internal system (OGS-4142).

The closest workaround to your ask would be utalising the escalation process from the responder alert generated from the Incident. 

A useful piece of information here is when an incident is closed:

• Responder alerts are also closed.

With the alerts generated from the Incident you can setup escalation rules to route to different teams so if the responder alert is not closed in 5 minutes, escalates to Team B, if not closed in 15minutes escalates to TeamC. Then with the above information if the Incident is closed, it closes the responder alerts automatically. 

Useful information:

• https://support.atlassian.com/opsgenie/docs/associate-an-alert-with-an-incident/
• https://support.atlassian.com/opsgenie/docs/how-do-escalations-work-in-opsgenie/

Thanks,

Connor