Incident creation based on alert aggregation groups

Sai Subrahmanya
Kilo Contributor


Hello Everyone,

Recently while I was working on Alert/Incident storm reduction problem, I came across this Alert aggregation and RCA groups. I have implemented this currently. But there is a issue that I'm currently facing, while using alert aggregation grouping Snow is creating different alerts under Automation and CMDB Group names. Now when I see these groups the incidents are being generated for Secondary alerts instead of Primary or Automation or CMDB type, this is only reducing noise in alerts but not helping incidents. My main goal is to reduce the storm of incidents, Can anyone help me with Making Primary or Automation or CMDB group type Alert generate incident and make Secondary alerts not to generate any incidents. Which means just one incident per group.

Thanks in advance,

J. Sai Subrahmanyam

1 ACCEPTED SOLUTION

Ashutosh Munot1
Kilo Patron
Kilo Patron

Hi,

There is already and flow and management rule which will create alert only for primary and not for secondary.:

Name:"Create Incident for Primary Alert"

find_real_file.png

 

There is one more event management rule for all alerts called as "Create Incident" Which will be active in your case. So you need to deactivate that and active first one.

Thanks,
Ashutosh

View solution in original post

7 REPLIES 7

christianmalone
ServiceNow Employee
ServiceNow Employee
You should update or duplicate your create incident flow and modify it to filter out secondary alerts

Ashutosh Munot1
Kilo Patron
Kilo Patron

Hi,

There is already and flow and management rule which will create alert only for primary and not for secondary.:

Name:"Create Incident for Primary Alert"

find_real_file.png

 

There is one more event management rule for all alerts called as "Create Incident" Which will be active in your case. So you need to deactivate that and active first one.

Thanks,
Ashutosh

HI,

If solved then close this thread so others can use it.

Thanks,
Ashutosh

Sai Subrahmanya
Kilo Contributor

Thank you @Ashutosh Munot and @christianmalone , I have tried using Create Incident for Primary Alert from Alert Management rule. Now I can see incidents for Primary incidents but, still I can see the incidents being created for Secondary alerts under the Automated and CMDB group. Is there a way that I can suppress these incidents for secondary alerts.