Why all incoming alert are associated with the only existing incident
Asked by serge calderara:

Dear all,

I have an Incident which has been previously created from an Alert through the following Incident rule :

![chrome_HGwIJZ5vCL.png](https://community.atlassian.com/t5/image/serverpage/image-id/149080iE18F888BF165A0CF/image-dimensions/427x300?v=v2 "chrome_HGwIJZ5vCL.png")

Then as a test I have a created manually a dummy Alert of P2 priority only with a different Alias than initial Alert which create the incident.

By doing so the created alert below, has been associated to the current incident BUT it has nothing to do with it as it is an other one, I was expected that a different incident would be created.

![chrome_fVh9WWdXD4.png](https://community.atlassian.com/t5/image/serverpage/image-id/149081i7A479659807F2F08/image-dimensions/348x348?v=v2 "chrome_fVh9WWdXD4.png")

Why opsgenie did not create new Incident ?

What is the rule that Opsgenie apply in order to know if it should create a new incident or associate the Alert to existing one ?

Thanks for clarification

regards


Answers:
author: Samir
body: Hi [@serge calderara](/t5/user/viewprofilepage/user-id/3385932)

If an incident is created through an incident rule, and that incident remains *open* , then all other alerts that are created that match that *same* incident rule, will be associated with the same incident.

So essentially there can only be 1 open incident per incident rule at a time.

Thanks,

Samir

comments: author: serge calderara
body: Hello [@Samir](/t5/user/viewprofilepage/user-id/2168284) ,

So in other words based on my configuration screen of Incident rules define in the current ticket, that means that any Alert where Priority = HIGH will be attached to that same Incident even if Alert as different Alias ?

Regards

serge


author: Samir
body: Yes that's correct, it will be associated to the same incident until that incident is closed. Once the incident is closed, if a new alert matches that incident rule, a new incident will be created.


author: serge calderara
body: [@Samir](/t5/user/viewprofilepage/user-id/2168284) Thanks for clarifiction

One more thing.

If in the Incdent rule I have the criteria as below :

Priority=HIGH  
Alert title CONTAINS "Network Incident for instance"

If an Incident is already OPEN based rule above then Alert will be associated to that open incident.

Now if a new Alert occurs with PRIORITY=HIGH and ALert title is " Server Down"

Then no incident will be created correct ?  

Depending on Incident rule settings I guess I could have more than 1 Incident OPEN at same time correct ?

regards


author: Samir
body: Yes that's correct, assuming that filter is set to "match all conditions below".


author: serge calderara
body: Hello [@Samir](/t5/user/viewprofilepage/user-id/2168284) thanks for your reply.

In practice what could be by experience a sampple filter on incident rule which will associate alert in a more logical way and not only for priority ?

Should I base the rules on the title of the alert, the service, ?

thanks for sharing

regards


author: Samir
body: It really depends on what sort of alerts indicate that you want an incident created. If there is something in the message of the alert that indicates an incident should be created, then filter on the message.

It comes down to which criteria dictates whether there should be an incident created or not, so it depends on your alerting setup and incident management practices.