Correlates related alerts into a single incident instead of flooding the team with separate alarms. It's opt-in per routing rule: switch a rule's Alert grouping setting to
Auto (AI)
, and the engine takes over from there, learning which alerts tend to fire together over time. No grouping keys to set.When multiple alerts fire close together, the engine works down a signal ladder to decide whether, and why, they belong together, checked in order:
- Same alarm rulefiring on multiple targets, always merges. A rule firing across many hosts becomes one group with many instances, not a separate ticket per host
- A shared identity label;both key and value must match(host_name=fedoraandhost_name=ubuntudo not match)
- Co-fire history, alerts that have repeatedly fired together before
- A known cause-effect pattern, e.g. a DynamoDB throttle causing Lambda errors
- Topology, the entity graph connects the two resources
- An LLM pass, for novel combinations nothing above can explain
Each group shows its members and a
"Why grouped"
reason. You can thumbs-up or thumbs-down a grouping decision; a single thumbs-down is a one-off override, but a second person flagging the same pairing stops it from grouping that way again. Groups link directly into Run RCA
for investigation.
Check out Alert Grouping: Static or Auto (AI) and How Alert Grouping Works for full details.