Clear event to close the alert.

[ayush_saxena]

We have a scenario where if the monitoring system sends critical incident it should be assigned to Group A, if warning event is received it should be assigned to Group B. This can be achieved by event rules , the tricky part is how to close the alert when source i.e monitoring system sends a clear event ? As event rules are severity driven the severity of clear events differs

Has anyone implemented something alike before?

[ayush_saxena]

We are not creating new incidents, we are just updating the existing ones. Already have logic for clear events to close alerts and resolve incidents in place. 

[stevemacamway]

Ayush,

If it were me, I would probably do the following:

1. Keep it limited to one alert.
2. Use Alert Rule to assign the ticket to Group B. 
3. Use BR on Incident table to re-assign the Incident to Group A 
4. 1. On insert / Update
   2. Only if the Assignment Group is Group B.
   3. This will keep it from running when Group A is already assigned, as well as if the ticket has been re-assigned to another group. 

Steve