Only perform close action on OEC when action is triggered by user

[Marius.Myrbakk]

We have a two way integration with our monitoring system that closes alerts in opsgenie when the alarm is cleared and we also have OEC installed to clear the alarm in the monitoring system if the corresponding alert in opsgenie is closed.

However we do not want OEC to perform a close action if the alarm is already cleared in our monitoring system, only if the alert is closed by a user in opsgenie while the alarm is still active.

I've tried solving this using Alert Filter in OEC settings and matching the condition Details (key/value) username NOT Contains Alert API

as I noticed in the logs that the payload for all alarms not manually closed by a user contained "username":"Alert API"

This did unfortunatly not work and I see close actions are still executed.

This does not have any service impact as the close action on allready closed alarms are ignored by the monitoring system, but it is spamming our logs.

Is this possible to solve in opsgenie configuration or do I need to add a function in the close-script in OEC?

[Marius.Myrbakk]

Another option could be for the integration that closes the Alert to add a tag and then filter on that tag in the OEC action filter, but I would still like to know if there is a way of doing it in Opsgenie with the information that is already there.