Hello All,
I am facing two issues, if anyone can help it very much appreciated:
Issue 1) My first requirement is Primary alert should be converted into Incident and if any secondary alerts comes it shouldn't create an incident. I created a Alert Action rule with condition: Role in Group is not secondary then only create Incident but what i have observed as soon as events converted to alerts, incidents are getting created and Alerts correlation Rules running later to Group the alerts as primary and secondary but at that time Incidents were already created in the system for Secondary alerts.
am i doing wrong something or is it the intended behaviour from service now
Issue 2) Primary alert closing the secondary alerts. How i can changed this Behaviour, where in the system this logic is written. My requirement says Primary alert shouldn't close the Secondary alerts.
Can anyone or Tony Branton please help to understand if this is OOTB behaviour and how i can control or am i missing something somewhere.
Thank you in advance.
