> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aciona.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Grouping and auto-resolution

> How aciona.me avoids duplicate incidents and closes what the tool has already recovered.

An alert that fires a hundred times should not create a hundred incidents. And an alert that recovers on its own should not leave an incident open forever. Both depend on the same mechanism: **correlation**.

## Grouping (deduplication)

When an alert arrives, aciona.me looks for an **open** incident from the same origin, considering the organization, the service, the alert's external identifier and a signature computed from the normalized content.

<Steps>
  <Step title="An open incident was found">
    The alert is **aggregated** into the existing incident. The timeline records an alert-aggregated event, and no duplicate is created.
  </Step>

  <Step title="None was found">
    A new incident is created, with its own notification and escalation clock.
  </Step>
</Steps>

<Tip>
  If you are seeing duplicate incidents for the same problem, the correlation identifier sent by the tool is probably changing on every trigger. Check the table below.
</Tip>

## Auto-resolution

When the originating tool sends the recovery event, aciona.me finds the correlated open incident and resolves it automatically.

Guaranteed behavior:

* **Recovery with no matching open incident:** nothing happens. The alert is recorded, no incident is created and no error is raised.
* **Recovery for an already resolved or closed incident:** ignored, without reopening or modifying anything.
* **Auto-resolution records the event on the timeline**, identifying the source that resolved it.

## The correlation identifier per tool

| Tool                    | Identifier                                | What must be switched on                      |
| ----------------------- | ----------------------------------------- | --------------------------------------------- |
| Prometheus Alertmanager | `fingerprint`                             | `send_resolved: true` on the receiver         |
| Grafana Alerting        | `fingerprint` (with rule-based fallbacks) | "Disable resolved message" **off**            |
| Datadog                 | `alert_cycle_key` (fallback: `alert_id`)  | `@webhook-<name>` outside `{"{{#is_alert}}"}` |
| New Relic               | `issueId`                                 | `Closed` checked under "Notify when"          |
| Zabbix                  | `triggerId`                               | Action firing on PROBLEM **and** RECOVERY     |
| AWS CloudWatch          | `alarmArn`                                | `OKActions` pointing at the SNS topic         |
| Generic webhook         | `externalId`                              | No auto-resolution                            |

<Warning>
  In every tool, the right-hand column is the most-forgotten configuration step. Without it, incidents open normally but **never close on their own** — and the failure is silent.
</Warning>

<Columns cols={2}>
  <Card title="Incident did not auto-resolve" icon="life-buoy" horizontal href="/en/troubleshooting/no-auto-resolution" />

  <Card title="Correlation reference" icon="list" horizontal href="/en/reference/correlation-and-auto-resolution" />
</Columns>