Event Management: How to delay auto incident creation on purpose?

[Tezazu Asmelash]

Hello,

I am looking away to delay an auto incident creation for a little bit like 5 or 10 minutes. I tried it on the Alert Managment rule using filter conditions on Created or Updated, but that does not seem to work. Any ideas on how this can be achieved?

Thank you!

[Jeff K1]

You can't find it because there is no script section at the event rule or alert management rule level.

If it's something that you get multiple events for over a period of time, I'd look at thresholding in the event rule level.

While it is an interesting idea to attempt it at the alert management level based on created or updated time like you've attempted; I'm going to guess that fails you because the alert won't attempt to trigger another alert management rule until it is updated. So your initial not creating an incident immediately works, but then the alert would need to keep being updated until the time gets beyond your trigger.

I'd say the flow idea is still your best bet. But if you really don't want to create a pass-through flow that looks for your exceptions, you can also look at a business rule.

[jpn]

Hello Tezazu Asmelash, were you able to get the solution, even i am also interested to know about how to handle the INC Creation delay via Event rule, but not found script section where we need to invoke Apparently! pls let me know incase of alternative solution that you may have found.

TIA

[Johannes]

This is now an OOTB feature:
https://youtu.be/meAEeHrOzAk?si=SufWzb8uqBvPJzSn&t=679