Moving Alert to Different Team

[Deleted user]

Hello, looking for creative guidance on the best way to solve the use case:

Setup:

- JSM hooked up to Opsgenie (JSM ticket creates Opsgenie Alert to same team)

- JSM hooked up to JIRA (JSM ticket create JIRA ticket to same team)

- Have automation in place to add comments and close tickets 

Question: What if a user creates a JSM ticket to the wrong team?

- We can manually move a JSM ticket to a different desk

- Then manually move a JIRA ticket to a different project

? But how do we move the Opsgenie Alert - I'm not seeing any documents or suggestions

[Connor Eyles]

Hi Chris!

Thanks for providing the use case but when it comes to "alerts" they always live in the same place but can have different responder teams.

Let's talk through the scenario:

• The user creates a JSM ticket that creates an alert for Team B, It was actually intended for Team A.
• This has already created the alert for Team B and has started notifying team B
• You manually move the JSM ticket over to the correct project.
• The next steps here would be adding a new responder team to the Opsgenie alert

You can use the 3 dots on the alert to add a responder team, add Team A and this will start the notification process for the correct responder team and they will gain visibility to the alert. 

Does this answer your questions here? If not please elaborate further 

Thanks,
Connor

[Deleted user]

Thanks Connor, is there a way to remove responders?  On our example, get it off Team B's list?  I've seen it mentioned in the docs, but I don't see it in our environment.   

https://docs.opsgenie.com/docs/add-remove-responder

[Connor Eyles]

Hi @[deleted] 

You can remove responders from an incident but not an alert. The documentation that you provided does mention incident.

Thanks,
Connor

[Blake Waud]

Hi @Connor Eyles 

This is similar to a use case we are having trouble with, we have a team dedicated to handling severe alerts when they first hit our systems. They add the appropriate responder team and then un-acknowledge the alert so the new team can see it is not owned; however, if that team does not acknowledge, the triage team's escalation policy will kick in, alerting the entire triage team.

How do we prevent this?

Thanks,

Blake

[Connor Eyles]

Hi Blake!

This is definitely an interesting use case but once you unacknowledge an alert the alert is treated as an unacknowledged alert meaning the escalation policies will kick in for the triage team.

I've put some thought into this and can suggest a possible workaround so that your triage team doesn't have to deal with the notifications re-triggering.

If you use Slack or Microsoft Teams you can set up an integration for all new alerts that the tirage team can manage. The triage team can also use comments or reactions on the alert within slack to let the triage team that the alert has been taken care of. The triage team then clicks on the alert from slack and assigns the correct responder team and it will stay unacknowledged.

So to sum up the workflow

• A new alert is created with no responder team
• Notifies a slack channel that the triage team manages.
• The triage team goes into the alert to review and assign responder team
• The responder team is added and then notified.

I hope this helps!

Thanks,

Connor

[Blake Waud]

Thanks, that makes sense and we were looking at integrating Teams anyway.

One of our users may have discovered another way as well. They added the appropriate responder team and did not UnAck. In looking at the activity logs, it appears the system did use the new team's routing rules, escalation policy, and schedule correctly, without pinging the original team again.

We may just need to accept that an acknowledged alert you've been pinged on might not belong to the person who currently owns it because they are in fact trying to pass it to your team.

Thanks,

Blake

[Connor Eyles]

Hi @Blake Waud 

Great find! This can also work 

Thank you for sharing another approach to this use case!

You can still always add a responder team to an already acknowledged alert which will still add the correct members as responders to the alert!

If you have other concerns or want to discuss other methods on ways to approach setting up Opsgenie feel free to reach back out.

Thanks,
Connor