# Turn repeated monitoring alerts into one incident, not ten **URL:** \ **Category:** Use Case Hub\ **Created:** [October 16, 2026, 11:45am UTC](https://community.autommate.com/t/turn-repeated-monitoring-alerts-into-one-incident-not-ten/224 "2026-10-16T11:45:38Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Caglayan](https://avatars.discourse-cdn.com/v4/letter/c/f9ae1b/32.png) [@Caglayan](https://community.autommate.com/u/Caglayan)\ **Post date:** [October 16, 2026, 11:45am UTC](https://community.autommate.com/t/turn-repeated-monitoring-alerts-into-one-incident-not-ten/224/1 "2026-10-16T11:45:38Z")
_Autom Mate Team · Practical example_ A monitoring tool sends the same alert every few minutes. The service desk needs one incident with useful updates, rather than a fresh ticket for every message. **Start with one alert type:** 1. **Receive the event.** Configure a webhook trigger and read the customer, monitored object, alert type and source event ID. 2. **Build a matching key.** Combine customer, object and alert type. Keep customers separate even when their server names look identical. 3. **Look for an active incident.** Search the destination system or your maintained cross-reference. Repeated delivery of the same event should not create another record. 4. **Create or update.** Create the first incident and save its ID. Add subsequent relevant changes to that incident, subject to a sensible update frequency. 5. **Handle recovery deliberately.** Add the recovery information, then follow the service desk’s resolution policy. **Example:** five disk-space alerts for the same customer and server point to one incident. A different customer’s server creates a separate incident. **Done when:** replaying an alert adds no duplicate ticket and recovery does not close unrelated work. Use [webhook triggers](https://docs.autommate.com/userguide/build-automations/choose-a-trigger-and-schedule) with the supported incident actions or API of your chosen system. Which alert type creates the most noise for your team?