youngmon/atlassian-qna huggingface dataset:
Alert Rules vs Alert Policies Best Practice
Asked by James Allen:

What is the best practice on when to use Alert Rules vs Alert Policies? The documentation ([Alert creation flow \| Opsgenie \| Atlassian Support](https://support.atlassian.com/opsgenie/docs/alert-creation-flow/)) describes the process of alert creation. First we have "Integration create alert rules", then the "Global alert policies" followed by "Team alert policies". I understand the difference between global and team alert policies and why you'd want to use one over the other but don't know what's the best practice with using the rules within the integration configuration vs applying alert policies afterwards.

I'm currently applying most of my logic at the Integration level, and can see that there are plenty of filters available there to support future use cases, but don't quite understand why you'd also have alert policies that seem to be able to do similar things.

What are the pros and cons of each approach?


Answers:
author: John M
body: Hi [@James Allen](/t5/user/viewprofilepage/user-id/5328525)

Great question! While integration actions and policies can perform the same function of modifying alerts, with the policies being processed only *after* the initial 'create' action, they are able to perform an additional round of modifications.

While the initial 'create' action might add some custom field from the payload to a different field in the alert body, the policy can then filter for that field and perform additional modifications based on it's value.

Policies can also be paused and automatically disabled and enabled using schedules via maintenance policies, so if you have a very specific modification that you may need to change, delete or pause at some point, it may be better to use a policy, rather than having to modify the integration configuration. This allows for better separation of concerns.

The other difference is that policies have a time-based filter, while integration actions do not. ![2023-09-28_20-47-41.png](https://community.atlassian.com/t5/image/serverpage/image-id/283630iF98B98D89C89E246/image-size/large?v=v2&px=999 "2023-09-28_20-47-41.png")

comments: author: James Allen
body: Thanks for that [@John M](/t5/user/viewprofilepage/user-id/4625213) I will continue to use the create actions for the alerts for now and then will rely on policies in future when I want to add more complex actions or if we decide to have different results depending on timing.
Opsgenie Alert Analytics in Grafana Dashboard?
Asked by Kostiantyn Rodionov:

Hello,

Is there any way to create a Grafana dashboard with Opsgenie Analytics graphs? Access the same analytics as "Opsgenie - Analytics - Alert MTTA/R Analytics" but through Grafana dashboards.

Thanks


Answers:
author: John M
body: Hi [@Kostiantyn Rodionov](/t5/user/viewprofilepage/user-id/5328120) ,

Opsgenie API doesn't have any endpoints for Analytics so unfortunately, at the moment that is not possible.

comments: author: Kostiantyn Rodionov
body: Thank you, we've already partially implemented analytics in Grafana using the Opsgenie REST API - Alert API.


Tags: cloud
Does Opsgenie support notifications in Huawei phone?
Asked by Boquiren Trina Marquez:

Hi,

My colleague installed Opsgenie App in her Huawei phone however she is not getting the alert/notification, what could be the issue? Is it supported?

![Screenshot_20230926_132102_com.ifountain.opsgenie.jpg](/t5/image/serverpage/image-id/283167i0FCA8B22DA22104A/image-size/large?v=v2&px=999 "Screenshot_20230926_132102_com.ifountain.opsgenie.jpg")

Thanks \& Regards,

Trina


Answers:
author: John M
body: Hi [@Boquiren Trina Marquez](/t5/user/viewprofilepage/user-id/2880569)

You can use Opsgenie on Huawei mobile devices that use HarmonyOS but it would be via a mobile browser. The Opsgenie app is only supported for iOS and Android so the app may not work properly on a Huawei phone, if installed.

However, the message you are seeing indicates that the user needs to add their mobile number to receive notifications. They can do that by going to "Notifications" and under "Contact Methods" adding a mobile number.

comments: author: Boquiren Trina Marquez
body: Hi [@Joh](/t5/user/viewprofilepage/user-id/4370607) ,

Thank you so much for your clarification.

We have already updated her number in Opsgenie and have installed in iOS device.

Thanks \& Regards.


Tags: cloud
How to get closed alerts without using Id or Tiny?
Asked by Shahanawaj Mulla:

I am trying to get closed alerts how do I get those?


Answers:
author: Nick H
body: Hi [@Shahanawaj Mulla](/t5/user/viewprofilepage/user-id/5326782) ,

You could list closed alerts using a URL like this:

<https://api.opsgenie.com/v2/alerts?query=status%3A%20closed>

I believe this only pulls the 20 most recently closed alerts - so continue to GET more alerts with other URLs like these:

* Next:
  * [https://api.opsgenie.com/v2/alerts?limit=20\&sort=createdAt\&offset=20\&order=desc\&query=status%3A+closed](https://api.opsgenie.com/v2/alerts?limit=20&sort=createdAt&offset=20&order=desc&query=status%3A+closed)
* First:
  * [https://api.opsgenie.com/v2/alerts?limit=20\&sort=createdAt\&offset=0\&order=desc\&query=status%3A+closed](https://api.opsgenie.com/v2/alerts?limit=20&sort=createdAt&offset=0&order=desc&query=status%3A+closed)
* Last\*:
  * [https://api.opsgenie.com/v2/alerts?limit=20\&sort=createdAt\&offset=140\&order=desc\&query=status%3A+closed](https://api.opsgenie.com/v2/alerts?limit=20&sort=createdAt&offset=140&order=desc&query=status%3A+closed)

(Last\* - would depend on the total alerts in your Opsgenie)

comments: author: Nick H
body: Related: <https://community.atlassian.com/t5/Opsgenie-questions/How-to-get-closed-state-alert-by-alias/qaq-p/2488916>


author: Shahanawaj Mulla
body: Can we use another key-like source to get a closed status alert? like source and status is closed


author: Nick H
body: Yes - you can realistically query just about any field using a GET on closed alerts except the alias. For example:

![get2.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/283083i949233345B543BF3/image-size/large?v=v2&px=999 "get2.jpg")

To verify my query I typically test in the UI, then use a [URL encoder](https://www.urlencoder.org/) so I know what to include in the API URL:

![get3.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/283084iB5F26A9A901A3D2C/image-size/large?v=v2&px=999 "get3.jpg")![get4.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/283085i737F63F669B2FDF5/image-size/large?v=v2&px=999 "get4.jpg")
How to get closed state alert by alias?
Asked by Shahanawaj Mulla:

I am trying to get an alert by alias but the alert status is closed. So I am getting the following response   

<br />

{  
"code": 40401,  
"message": "Alert with alias \[f552cfaa-e28d-40d6-86b4-86b80335d3c6\] not found.",  
"took": 0.002,  
"requestId": "2b49b30b-7c94-428a-8d41-aae729efb2ba"  
}

<br />

<br />

<br />

<br />


Answers:
author: Nick H
body: Hi [@Shahanawaj Mulla](/t5/user/viewprofilepage/user-id/5326782) ,

It's unfortunately not possible as stated at the [Get Alert](https://docs.opsgenie.com/docs/alert-api#get-alert) section here:

![get1.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/283050i0EE14B54F6CD3AF7/image-size/large?v=v2&px=999 "get1.jpg")

comments: author: Shahanawaj Mulla
body: Any other way to get closed alerts


author: Nick H
body: You could list closed alerts using a URL like this:

<https://api.opsgenie.com/v2/alerts?query=status%3A%20closed>

The alert's ID and tiny ID should be returned.
Can I create ServiceNow incident Using Actio n Channel?
Asked by Jugal_Shroff:

I want to create ServiceNow incident automatically if certain alert conditions are true can I automate this entire process using Alert Action.


Answers:
author: John M
body: Hi [@Jugal_Shroff](/t5/user/viewprofilepage/user-id/5002746) ,

You can create a Service Now incident automatically using the

"For other Opsgenie alerts: Create ServiceNow Incidents for Opsgenie Alerts:"

section and apply a filter for the field you want the condition to apply to.

Here is an example:

![2023-09-25_16-28-58.png](https://community.atlassian.com/t5/image/serverpage/image-id/282836i56FECF04FFCB6334/image-size/large?v=v2&px=999 "2023-09-25_16-28-58.png")

comments: author: Jugal_Shroff
body: [@John M](/t5/user/viewprofilepage/user-id/4625213) Thanks for this information, my concern here is my Service Reliablity team created certain monitors in DD, for example 3 out of 5 or all 5 monitors triggered an alert which automatically gives confirmation that it is an actual issue. In this scenario, a Service Now incident should be created as soon as these three or 5 monitor alerts get triggered.


author: John M
body: [@Jugal_Shroff](/t5/user/viewprofilepage/user-id/5002746) that could be tricky. There might be some way to do it depending on the data in the alerts. If you're able to, I would open a support ticket or a chat so we can look at your account and see if there's any way we can figure something out.


author: Jugal_Shroff
body: Sure, let me take this up internally, I will reach out to you. Pasting alert information in the open forum will be compliance issue for me. Please suggest how to provide alert information.


author: John M
body: You can raise a private support ticket here:

<https://support.atlassian.com/contact/#/>


author: Jugal_Shroff
body: I will raise through our org .


Tags: cloud
Opsgenie Zendesk integration
Asked by Mohammed Elghrably:

I'm trying to integrate Zendesk with Opsgenie knowing that I'm on Essentials plan and as the documentations instruct, I can with the following steps   
![snap.png](/t5/image/serverpage/image-id/282530iAAA3C4607A496C9F/image-size/large?v=v2&px=999 "snap.png") but trying this didn't work , I find this very confusing![2.PNG](/t5/image/serverpage/image-id/282531i4047C236096169F1/image-size/large?v=v2&px=999 "2.PNG")


Answers:
author: Rafael Meira
body: Hey [@Mohammed Elghrably](/t5/user/viewprofilepage/user-id/5324724)   

Thank you for your question.  

It would be better if you could open a formal support ticket with our team, so we could investigate it, verify your account, share information, and so on.  

Please, to open a support ticket with us, you may go to <https://support.atlassian.com/contact/>   

We will be waiting for your ticket to assist you.  

You can essentially post the same information on the ticket.  

<br />

Thanks!  
Rafa


Tags: cloud
Get Schedule of a team in Opsgenia
Asked by Sheher Yar:

Hi, I am trying to get the schedule of a team for specific dates lets suppose 27 of the last month to 27 of the current month so I apparently use the month parameter and I add the date for some reason I always get the result from 31 for the previous month to next month is there a technical limitation that we can set custom dates from a specific date to a specific date.

![Screen Shot 2023-09-20 at 2.08.45 pm.png](/t5/image/serverpage/image-id/281641iCBEC8D7FB56048C8/image-size/large?v=v2&px=999 "Screen Shot 2023-09-20 at 2.08.45 pm.png")


Answers:
author: Animesh Singh
body: Hello,

Greetings!

Thank you for reaching Atlassian. I have tested the behaviour that you have mentioned and yes by design the API returns data in a period of "Week to date" a "month to date" and "year to date" which results in you seeing it returning the start and end dates as the ones you have correctly mentioned.

However, as your requirement is to get the results of a 30-31 day (a month) time frame, you can make use of interval, intervalUnit=days and specify the startDate to get the desired results.

Here is an example for the same (I am just filtering out the startDate and the endDate for the entire data this method lists out),

# curl --silent -X GET '[https://api.opsgenie.com/v2/schedules/SCHEDULE_ID/timeline?interval=31\&intervalUnit=days\&date=2023-08-21T00:00:00%2B00:00](https://api.opsgenie.com/v2/schedules/SCHEDULE_ID/timeline?interval=31&intervalUnit=days&date=2023-08-21T00:00:00%2B00:00)' --header 'Authorization: GenieKey Your_API_Key_here' \| jq '.data.startDate, .data.endDate'

"2023-08-21T00:00:00Z"  
"2023-09-21T00:00:00Z"

I hope this helps and I wish you an amazing day ahead!

Best Regards,

Animesh

Cloud Support Engineer

comments: author: Sheher Yar
body: Hi Animesh your answer worked for me however adding to above I have a small query is it possible to define a range to get schedule like If i want to get schedule from 2023-08-21T00:00:00Z to specifically 2023-08-23T00:18:00Z so for 2 days and some hours till 23/08/2023 till 6pm can we define a boundry in the api call such that i porvide a startv date and end date and get the roster i think current intervals are day , date , month and in documentation there isn't mention an end date parameter.


author: Animesh Singh
body: Hello again,

Hope you are doing great. Your usecase is as I understand to get schedules for 2 days and 18 minutes of timeline as an example. You are correct the interval unit is as mentioned below,

```
{"message":"intervalUnit should be one of [days, weeks, months]","took":0.008,"requestId":""}
```

Which means for getting the schedule for 18 minutes on top of day 2, you will be needing to get the schedule timeline for the 3 days and then go ahead and filter the information as required.

I hope this helps and have a great day ahead!

Regards,

Animesh

Cloud Support Engineer


Tags: cloud
{{triggerDescription}} {{triggerUrl}} parameters via API
Asked by matvey.teplov:

Good afternoon Everyone,

I am looking into OG alert API (and perhaps a python wrapper) at <https://docs.opsgenie.com/docs/python-sdk-alert>, and I cannot find triggerUrl and triggerDescription parameters in the json'ized parameter set. Anyone knows how can I get a handle on these?

Regards


Answers:
author: Rafael Meira
body: Hey [@matvey.teplov](/t5/user/viewprofilepage/user-id/4715053)   

The \`triggerUrl\` and \`triggerDescription\` parameters won't be directly available in the OpsGenie Alert API. However, you can potentially use custom fields to include this information in an alert.  

I will send you some suggestions below:

Looking at the OpsGenie Alert API documentation, you can pass extra properties as a dictionary using the \`details\` parameter when you create an alert. For example, you can do something like this:

\`\`\`python  
from opsgenie.swagger_client import AlertApi, AddAlertRequest, UserRecipient, TeamRecipient  
from opsgenie.swagger_client.models import CreateAlertNoteRequest  
from opsgenie.swagger_client.rest import ApiException

alert_api = AlertApi()

body = AddAlertRequest(  
message="Server CPU Usage High",  
alias="Server-1",  
description="CPU Utilization has reached 90%",  
responders=\[  
UserRecipient(username="john.doe@your-domain.com"),  
TeamRecipient(name="ops_team")  
\],  
actions=\["Restart", "AnExampleAction"\],  
tags=\["Overload", "Critical"\],  
details={  
"triggerUrl": "<http://example.com/triggerUrl>",  
"triggerDescription": "This is the trigger description"  
},  
entity="Server-1",  
priority="P1"  
)

try:  
response = alert_api.create_alert(body=body)  
print(response)  
except ApiException as err:  
print("Exception when calling AlertApi-\>create_alert: %s\\n" % err)  
\`\`\`

In this example, we're using the \`details\` dictionary to add custom fields for \`triggerUrl\` and \`triggerDescription\`. Note that these fields should then be accessible in the alert details on the OpsGenie user interface.

Let me know if the information above was indeed useful.

<br />

<br />

Best,  
Rafa

comments: author: matvey.teplov
body: Hi Rafa,

Yes, the payload can be manipulated like:

body = og.CreateAlertPayload(  
message='Message from: ' + datetime.datetime.utcnow().isoformat(),  
alias=str(uuid.uuid1()),  
description='ABCDEF',  
responders=\[{  
'name': 'SampleTeam',  
'type': 'team'  
}\],  
visible_to=\[  
{'name': 'Sample',  
'type': 'team'}\],  
actions=\['Restart', 'AnExampleAction'\],  
tags=\['OverwriteQuietHours'\],  
details={'key1': 'value1',  
'key2': 'value2',  
'URI': "<https://www.google.com>",  
'received': datetime.datetime.utcnow().isoformat()  
},  
entity='pack1/' + str(uuid.uuid1()),  
priority=alert_priority,  
source="Runaway",  
note="Blah-blah-bla"  
)

Thank you for your reply!

Regards Matt


author: matvey.teplov
body: Hi Rafa,

Yes, I did about that and it worked successfully. Thank you for replying, though!

Cheers


Tags: api

cloud

rest-api
Solarwinds - Opsgenie Integration
Asked by Dianey Benitez:

I will be setting up a bunch SW alerts within the integrayion but before I proceed, can someone kindly advise if using 1 integration is ok to use for all alerts (regardless of triggering objects and nodes)? I am asking this because there had been another integration that I worked on involving SW but that "other" platform's support advised to use 1 integration per alert. This was their recommendation after I raised an issue on some the alerts that aren't getting through to their end.

It looks like I can get away with 1 integration for everything in Opsgenie as long as my filters are set up properly, I think?! But I thought to check if this is a good (if not the best practice) for Opsgenie-SW integration?  

Thank you in advance!

Di


Answers:
author: John M
body: Hi [@Dianey Benitez](/t5/user/viewprofilepage/user-id/5319593) ,

You should be able to use one integration without any issues, however, I would recommend setting up a test integration to verify the results before you go live with either option.

Using multiple integrations can serve as a way to partition alerts and infrastructure using different integration names, different teams, and different schedules, but that is not always necessary, it really depends on your individual requirements.

comments: author: Dianey Benitez
body: Wonderful. Thanks for the confirmation and the suggestion as well!  

.


Tags: cloud
Opsgenie alert after 2nd trigger and in the timespan of 4 hours
Asked by Marco Grima:

Hello,

I am trying to see if we can configure an opsgenie alert based on receive 2 identical slack messages (same channel)in the max timespan of around 4 hours.

i appreciate the help.

Marco


Answers:
author: John M
body: Hi [@Marco Grima](/t5/user/viewprofilepage/user-id/5278459) ,

Our Slack integration can create Opsgenie alerts from Slack based on [slash commands](https://support.atlassian.com/opsgenie/docs/integrate-opsgenie-with-slack-app/#Using--genie-Command), but there is no option to create alerts based on receiving identical Slack messages. However, you could build something like that with some scripting and the Slack API.

comments: author: Marco Grima
body: Thanks for the helpful response ?.


Tags: cloud
Meaning of "Total Alerts" column in "Alert Metrics Per User"
Asked by Kenny Vu:

I'm viewing Team Productivity Analytics, and on this page, there's a table for "Alert Metrics Per User". There are 3 columns I have questions about: Total Alerts, Acknowledged Alerts, and Escalated Alerts. For many people on our team, Total Alerts is NOT the sum of Acknowledged Alerts and Escalated Alerts, and I'm trying to understand why. Here are some of the reasons why I think they may not sum up:

* Alerts may be closed before they are ack'd or escalated
* Alerts may not be acked but also may not have an escalation policy defined

The 2 scenarios above would account for when the sum of ack'd alerts and escalated alerts is lower than Total Alerts.

Is my understanding above correct?

But how do I have team members where the total Number of Alerts is less than the sum of ack'd alerts and escalated alerts? Could this happen when teammates have alerts escalated to them from someone else?![Untitled.png](https://community.atlassian.com/t5/image/serverpage/image-id/281342i88998EB372175372/image-size/large?v=v2&px=999 "Untitled.png")


Answers:
author: Skyler Ataide
body: Hey there Kenny!

The**Alert Metrics per User** report shows the total alerts that the user received, how many of those total alerts were [acknowledged](https://support.atlassian.com/opsgenie/docs/acknowledge-and-unacknowledge-an-alert/) by that same user, and how many of those total alerts got [escalated](https://support.atlassian.com/opsgenie/docs/escalate-an-alert/). Total alerts would *not* have to be the sum of Acknowledged Alerts and Escalated Alerts. This is because the Acknowledged Alerts and Escalated Alerts are drawn from the total pool of alerts that were assigned to the user.

For example, looking at the first row/user in the screenshot you provided. This user received a total of 5 alerts. Of those 5 alerts, they acknowledged 3 of them, and 2 of them were escalated. It is possible for the same alert to be acknowledged, as well as escalated. In this case, that alert would be counted in all three columns.

Let me know if this makes sense of if you have any questions! Also, [here is a link to our documentation on the**Alert Metrics per User**report](https://support.atlassian.com/opsgenie/docs/view-global-alert-and-user-productivity-analytics/#:~:text=Alert%20Metrics%20per%20User%3A).

comments: author: Kenny Vu
body: Thanks, Skyler. This makes sense. A follow-up question...

If an alert is escalated from user A to user B, does user B's alert count increase by 1?


author: Skyler Ataide
body: You're welcome! In this case where an alert is escalated from user A to user B, user B's alert count does increase by 1. This alert would be counted in the "Total Alerts" column for both user A and user B, and it would also be counted in the "Escalated Alerts" column for user A.

The "Total Alerts" column is calculated for users that are notified for an alert. So if both user A and user B are notified for the same alert, then it will be counted in the "Total Alerts" column for both users.


Tags: cloud
Incident Rule Associates Alerts instead of Creating New Incidents
Asked by Robert Wen_ReleaseTEAM_:

I have an Incident Rule created for a team to create an Incident based on From criteria of the Alert that was created(I'm using the Email integration). It created the first Incident beautifully.

I'm noticing on subsequent Alerts, the Alert logs say they are creating the Incident, but they are really associating to the first Incident (the first Incident is still open).

How do I change the behavior so that each alert creates a separate Incident?

Thanks in advance!


Answers:
author: John M
body: Hi [@Robert Wen_ReleaseTEAM_](/t5/user/viewprofilepage/user-id/3970316) ,

What you're seeing is called "[Auto-matched alert behavior](https://support.atlassian.com/opsgenie/docs/automatically-create-an-incident-via-incident-rules/)."

After an incident is opened, alerts matching the same incident rule automatically become associated alerts of that incident. Opsgenie doesn't send alert notifications for these alerts. This aims to reduce alert fatigue.

The best ways to avoid this are to:  

1. Close incidents in a timely manner to prevent unwanted auto-matching (only open incidents can be auto-matched).

2. Create incident rules that are specific enough to only match the intended alerts (incident rules with filters that are too broad or vague will likely cause unwanted auto-matching).

3. Since matching occurs from top to bottom, if you are using multiple incident rules be sure place the most specific at the top and the lease specific at the bottom (this will allow alerts to match the correct rule).

comments: author: Robert Wen_ReleaseTEAM_
body: Thanks, [@John M](/t5/user/viewprofilepage/user-id/4625213) ! I had a feeling it was a feature and not a bug!