Skip to main content
An alert that fires a hundred times should not create a hundred incidents. And an alert that recovers on its own should not leave an incident open forever. Both depend on the same mechanism: correlation.

​
Grouping (deduplication)

When an alert arrives, aciona.me looks for an open incident from the same origin, considering the organization, the alert source, the service, the alert’s external identifier and a signature computed from the normalized content.
1

An open incident was found

The alert is aggregated into the existing incident. The timeline records an alert-aggregated event, and no duplicate is created.
2

None was found

A new incident is created, with its own notification and escalation clock.
If you are seeing duplicate incidents for the same problem, the correlation identifier sent by the tool is probably changing on every trigger. Check the table below.

​
Auto-resolution

When the originating tool sends the recovery event, aciona.me finds the correlated open incident and resolves it automatically. Guaranteed behavior:
  • Recovery with no matching open incident: nothing happens. The alert is recorded, no incident is created and no error is raised.
  • Recovery for an already resolved or closed incident: ignored, without reopening or modifying anything.
  • Auto-resolution records the event on the timeline, identifying the source that resolved it.
  • A source never resolves another source’s incidents. Recovery only closes open incidents opened by the same alert source.
Correlation never crosses alert sources. If two sources (say, Grafana and Prometheus) send the same problem, each opens and resolves its own incident. To group them, send the alerts through the same source.

​
The correlation identifier per tool

In every tool, the right-hand column is the most-forgotten configuration step. Without it, incidents open normally but never close on their own — and the failure is silent.

Incident did not auto-resolve

Correlation reference