How to prevent child alerts from generating incidents (alert aggregation)

[Mp1999]

Hello everyone,

I would like to know if there is a way, through business rules or any other method, to create incidents only for the parent alert and not for the child alerts that are generated. I am attaching an image. Thanks in advance

[Pratiksha]

alert management rule - > trigger condition should check if the parent field is empty on the alert. Also, you can make sure that incident is getting created only for primary alerts.

[Mp1999]

Hi @Pratiksha  ,

My filters are set up like this, but I still see alerts that are part of a group, such as the secondary group, continue to generate incidents:

[Pratiksha]

Group should be primary or empty. 

Also, OOB their is an alert management rule for primary alerts. Check it out in your PDI

[Mp1999]

Thank you very much, @Pratiksha   I have achieved my goal, but I still have one question: regarding alerts that have the group CMDB, how do these alerts behave and why do they never trigger incidents? Thank you very much in advance!