Skip to main content
An alert that fires a hundred times should not create a hundred incidents. And an alert that recovers on its own should not leave an incident open forever. Both depend on the same mechanism: correlation.

​
Grouping (deduplication)

When an alert arrives, aciona.me looks for an open incident from the same origin, considering the organization, the service, the alert’s external identifier and a signature computed from the normalized content.
1

An open incident was found

The alert is aggregated into the existing incident. The timeline records an alert-aggregated event, and no duplicate is created.
2

None was found

A new incident is created, with its own notification and escalation clock.
If you are seeing duplicate incidents for the same problem, the correlation identifier sent by the tool is probably changing on every trigger. Check the table below.

​
Auto-resolution

When the originating tool sends the recovery event, aciona.me finds the correlated open incident and resolves it automatically. Guaranteed behavior:
  • Recovery with no matching open incident: nothing happens. The alert is recorded, no incident is created and no error is raised.
  • Recovery for an already resolved or closed incident: ignored, without reopening or modifying anything.
  • Auto-resolution records the event on the timeline, identifying the source that resolved it.

​
The correlation identifier per tool

In every tool, the right-hand column is the most-forgotten configuration step. Without it, incidents open normally but never close on their own — and the failure is silent.

Incident did not auto-resolve

Correlation reference