Hi team,
I have below setup,
couple of on-premise and SaaS based monitoring tools data ( alerts) are integrated with ServiceNow ITOM, alerts are received at ITOM and getting converted to incident via Create incident workflow triggered from Alert mgmt rule.
The scenario I have is, sometimes due to network glitch or other issues, we get bulk alerts which are false alerts and with the existing setup all those gets converted to incidents automatically.
I would like to have a check on bulk alerts before converting them into incidents?
( example: check if you received 20-30 alerts for same metric in 30-60 seconds time then mark it as bulk alert scenario and create only one incident stating Bulk alerts received -please check and tag all those alerts to this incident)
Please let me know if this can be feasible and if yes then really appreciate the code or steps.
Thanks,
Guru
