Autom Mate Team · Practical example
A monitoring tool sends the same alert every few minutes. The service desk needs one incident with useful updates, rather than a fresh ticket for every message.
Start with one alert type:
- Receive the event. Configure a webhook trigger and read the customer, monitored object, alert type and source event ID.
- Build a matching key. Combine customer, object and alert type. Keep customers separate even when their server names look identical.
- Look for an active incident. Search the destination system or your maintained cross-reference. Repeated delivery of the same event should not create another record.
- Create or update. Create the first incident and save its ID. Add subsequent relevant changes to that incident, subject to a sensible update frequency.
- Handle recovery deliberately. Add the recovery information, then follow the service desk’s resolution policy.
Example: five disk-space alerts for the same customer and server point to one incident. A different customer’s server creates a separate incident.
Done when: replaying an alert adds no duplicate ticket and recovery does not close unrelated work.
Use webhook triggers with the supported incident actions or API of your chosen system.
Which alert type creates the most noise for your team?