Is there a way to close an incident when associated alert is closed?

[zahur don]

We use slack integration in order to notify/ack/close alerts via slack. It would be great if we could close an incident when its associated alert is closed from slack. is that possible?

[Samir]

Hi @zahur don ,

There isn't a way to have the incident automatically be closed when an associated alert is closed. There can be several associated alerts for an incident, and more alerts can be associated to an incident after the incident is created.

We do have a feature request to be able to close the incident when all associated alerts for an incident are closed.

Thanks,

Samir

[Veiko Jõõts]

Hi @Samir ,

Does this also apply vice versa, i.e., when I close an incident, is it possible to make it also close the Associated Alerts altogether with Responder Alerts(that already are doing so). Or is there another approach for this workflow?

What I want to achieve is: 

1. An external integration creates an (Associated) Alarm
2. A Service Rule is triggered which creates an Incident(which itself creates a Responder Alert automatically)
3. We resolve and close the Incident
4. The Incident and all associated alerts(including Associated Alert(s), that triggered the Incident creation) get closed without us needing to manually close the Associated Alert(s) after already closing the Incident.

[Samir]

Hi @Veiko Jõõts ,

Currently it is not possible to have the associated alerts get closed when the incident is closed, although we do have a feature request for this!

What some users do is setup a webhook integration to trigger when the responder is closed, to trigger a script on AWS Lambda or something which will close the incident via API. You could also setup a similar solution using Opsgenie Edge Connector (OEC).

Thanks,

Samir

[serge calderara]

hello @Veiko J , I need to do the same thing actually but seems a lot of logical approach are a feature request so far.

By the way I would be interrresting to know what is your process of solving a Incident.

What I mean and what is not clear is the use of the Responder Alert created at same time of the Incident which is a copy of the source Alert.

Do you work on the incident starting from the responder Alert, or the incident itself ?

What is the use of this responder alert exactly as based on docuementation is nothing else than pulling notification to responders member.

But the source Alert can do the same , why not working on the source Alert then ?

Simply because it can be off at some time automatically ?

Thanks for advise

regards