Nested Rules

[ACME MS]

Is it possible to create nested rules in opsgenie? For example, I have 2 rules in cloudwatch, 

CPU utilization exceeds 80%, then alerts should come as P1.

CPU utilization exceeds 70%, then alerts should come as P2.

I need the alerts to get suppressed rather than logging it as 2 seperate alerts/ tickets to jira. So, if its 70 then alert it as P2 and once it reaches 80 then alert it as P1 but not log it separately.

Please provide clarification on this. 

[Egor · Accepted solution]

Hey There,
Thanks for reaching out to Atlassian Community!

To achieve your goal of handling alerts based on CPU utilization and managing escalation without creating duplicate alerts, you can use OpsGenie’s Alert Policies and Integration settings. Here's a simplified guide:

1. Create Integration with CloudWatch: Set up your OpsGenie integration to receive alerts from AWS CloudWatch. Ensure both P1 and P2 conditions (CPU exceeds 80% and 70%, respectively) are configured in CloudWatch to send alerts to OpsGenie.

2. Use Alert Deduplication: In OpsGenie, utilize the deduplication feature to manage multiple alerts triggered for the same incident. Configure deduplication to match alerts based on a common identifier (e.g., instance ID or alert name).

3. Define Priority-Based Policies:

   • Filter by Condition: Use filtering rules in OpsGenie to categorize alerts into P1 or P2 based on the specifics in the alert message or custom fields sent by CloudWatch.
   • Update Priority: Use OpsGenie policies to automatically upgrade the priority of an existing alert (from P2 to P1) instead of creating a new alert, based on newer incoming data.

I hope this helps! 

Thank you,

Egor

[ACME MS]

Thank you, 

Can you please elaborate on Update priority part please? maybe the steps or screenshots etc,. 

[Muhammad Zeeshan]

Hey,

The updating priority works when for example, there is an existing Alert with priority P3 and alias 'test-alert-alias'. Then a new alert is created with the same alias 'test-alert-alias' but priority P1. In that case, that new alert will not be created as a separate alert, instead it will merged into the initial alert and raise its priority to P1.

Now you can implement it via your Integration settings and via your Alert policies. Please feel free to open a ticket on our Support channel here: https://support.atlassian.com/contact/ so we can assist you with a solution based on your current configuration and requirements.

BR,