Two screens decide what happens to each alert received:
- CI matching: which CMDB item the alert relates to;
- Processing rules: what to do with it, for example ignore it, notify a team or open an incident.
These screens are reserved for the Monitoring administrators, Service Desk administrators and Administrators groups. Open them from the Alert console. Every decision taken is written in the alert's Timeline, with its justification.
Match alerts to CIs
Each alert is matched only once, when it is received. Matching rules are tried in the order of the list; the first one that finds a single CI wins. A rule that finds several CIs matches nothing, to avoid a mistake: the next rule is tried. If no rule finds a single CI, the alert stays unmatched. Without any rule, the host name sent by the tool is looked up in the CMDB.
Click New matching rule and fill in:
- Name, Active and, if needed, the Source concerned (by default All sources);
- Value read: the alert information to use — Host (payload.source), Component, Group, Class, Summary, or Custom detail (custom_details) with its Path in the details;
- Extraction (optional): a regular expression that isolates part of the value. The first capturing group is looked up, or else the whole match;
- Lookup: how to find the CI —
- Host name: a full name also finds the short name;
- IP address: the address of a network interface returns the computer or device;
- External ID: references from imports (Intune, Ivanti, network inventory…);
- Field value: with the CMDB field (slug) to compare;
- CI type (optional): limits the lookup to one type.
The Move up and Move down buttons change the order of the rules. An alert that found no CI is flagged “Not linked to a CI” in the console.
If the CMDB is disabled, no alert is matched; processing rules without a CI condition still apply.
Processing rules
Rules are evaluated in the order of the list: the first one whose conditions are all met applies. An alert that no rule catches stays in the console, without an incident.
Click New rule, give it a Name, then choose:
Conditions (a condition left empty is always true):
- Source and Minimum severity;
- CI type or a specific CI;
- Text: searched case- and accent-insensitively in the summary, host, component, group and class;
- Alert linked to a CI: the rule only catches matched alerts.
Action:
- Ignore (noise): the alert goes to the Suppressed (noise) status, with the rule's name as reason;
- Log only: the alert stays in the console, nothing else;
- Notify: the alert stays in the console and a group is notified;
- Create or update an incident: an incident is opened in the Service Desk (see below).
Create or update an incident
- Required occurrences … within (minutes): the incident opens only after N occurrences within M minutes. This threshold avoids opening an incident for an alert that appears and disappears at once;
- Grouping by CI (minutes): alerts on the same CI within this window share a single incident; each alert joining it adds an internal note. Include related CIs extends the grouping to the CIs directly related in the CMDB;
- Automatic resolution: the incident is set to Resolved once all its alerts are resolved; the requester then confirms as usual;
- Category, Forced priority (otherwise Computed (impact × urgency)), Assigned group (otherwise Category routing);
- Incident requester: a service account is recommended. Left empty, it is the rule's author;
- Severity → impact and urgency: the incident's impact and urgency for each alert severity.
The incident is linked to the alert's CI. An alert that reopens or worsens adds a note to the incident. An incident already resolved or closed is never reopened: a new alert opens a new incident.
If the Service Desk is disabled, “incident” rules are traced on the alert but open no ticket.
Notification
For the Log only, Notify and Create or update an incident actions, the Notification section sets the Group to notify; the Nobody option notifies no group. The Notify only the group's on-call person option relies on the Service Desk on-call schedule; with no on-call shift in progress, the whole group is notified.
The notification is sent once per alert, and again on each reopening. Each person receives it in their language, by bell and email according to their preferences. No notification is sent during a maintenance window; for an “incident” rule, not before the threshold is reached.
Simulate before saving
Simulate over 7 days replays the rule on the alerts of the last 7 days, without changing anything: Alerts examined, Caught by the rule, Threshold reached, Estimated incidents, and for each alert the earlier rule that would already have caught it (Caught earlier by).
Order of the rules
The Move up and Move down buttons of the list change the evaluation order. Put the most specific rules first.
Reduce noise with AI
If an AI provider is configured, the Reduce noise card of the rule list offers Suggest rules. The AI analyses repeated alerts of the last 7 days that opened no incident and proposes at most five Ignore (noise) or Log only rules, never an incident rule. Create the rule opens the prefilled form: nothing is created without your approval.
When AI is disabled, the Reduce noise card does not appear. Matching, rules, simulation and incidents work the same.