Is there a way to create incident after event is generated 3 times?

[poojashah27]

i have a requirement from customer to create an incident after 3 events. e.g for windows machine someone tries to login and fails which triggers event to ServiceNow but if login fails 3 times then only create incident out of it.

[robertgeen]

So just one thing to note here the overall event count going up doesn't trigger an update on the alert. What this means is if the same event is tying back and no new changes have come in it doesn't update the last update time in my experience so you have to do this kind of thing in a scheduled job. Hope this helps.

[Gianpaolo Pagan]

Hi Robert,

I'd like to understand better what you mean here.

The flow I posted triggers on alert update (tested on london and madrid). So when overall event count changes its value and matches the condition (value greater than 2 in my example), so it actually triggers on the alert record update and it's not scheduled, unless I'm missing something here.

I'm happy to share the flow.

Gp

[robertgeen]

Try to push the same event through 3 times. If the contents of it don't change you will notice that the last update time on the alert doesn't iterate in my experience although the overall count does increase. This was done so there wouldn't be performance issues from what I understood from product management. The issue though is that alert management rules are run on a scheduled not on create/update so if the alert last update time isn't iterated it won't show up in the query. 

I did something exactly like this where the event count needed to be above 10 to create an incident. Can you show a screenshot of the alert after you push that same event through 3 times because I would be curious to see if the last update time is iterated (it shouldn't be unless the description or something is changing). Thanks.

[robertgeen]

So to save people reading our entire conversation on here GP suggestion should work in 99.9% of cases so I would go with it :). Thanks.