> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aciona.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Correlation and auto-resolution

> Which field each tool uses to match a trigger with its recovery, and what must be switched on.

aciona.me matches the alert that **opened** an incident with the alert that **closes** it using a stable identifier sent by the originating tool.

## Reference table

| Tool                    | Identifier                               | Required setting                     | Auto-resolution |
| ----------------------- | ---------------------------------------- | ------------------------------------ | --------------- |
| Prometheus Alertmanager | `alerts[].fingerprint`                   | `send_resolved: true`                | ✅               |
| Grafana Alerting        | `fingerprint` (fallback: rule id)        | "Disable resolved message" off       | ✅               |
| Datadog                 | `alert_cycle_key` (fallback: `alert_id`) | Webhook outside `is_alert` blocks    | ✅               |
| New Relic               | `issueId`                                | `Closed` checked under "Notify when" | ✅               |
| Zabbix                  | `triggerId` (`{EVENT.TRIGGERID}`)        | Action on PROBLEM **and** RECOVERY   | ✅               |
| AWS CloudWatch          | `alarmArn`                               | `OKActions` on the alarm             | ✅               |
| Generic webhook         | `externalId`                             | —                                    | Not supported   |

## Identifiers you should **not** use

| Tool       | Never use                      | Why                                                                       |
| ---------- | ------------------------------ | ------------------------------------------------------------------------- |
| Datadog    | `event_id` (`$ID`)             | Unique per event; never matches trigger to recovery.                      |
| New Relic  | Event or violation identifiers | They vary within the same issue.                                          |
| Zabbix     | `eventId`                      | Trigger and recovery are different events; only the trigger id is shared. |
| CloudWatch | The alarm name alone           | The ARN is the stable, unique identifier.                                 |

## States that open, close and are ignored

| Tool       | Opens                                                                   | Closes                   | Ignores                        |
| ---------- | ----------------------------------------------------------------------- | ------------------------ | ------------------------------ |
| Prometheus | `firing`                                                                | `resolved`               | —                              |
| Grafana    | `firing`, `alerting`                                                    | `resolved`, `normal`     | `paused`, `pending`, `no_data` |
| Datadog    | `Triggered`, `Re-Triggered`, `Warn`, `Re-Warn`, `No Data`, `Re-No Data` | `Recovered`              | `Renotify`                     |
| New Relic  | `CREATED`, `ACTIVATED`                                                  | `CLOSED`                 | —                              |
| Zabbix     | `value = 1` / `PROBLEM`                                                 | `value = 0` / `RESOLVED` | —                              |
| CloudWatch | `ALARM`                                                                 | `OK`                     | `INSUFFICIENT_DATA`            |
| Generic    | `firing`, `alerting`                                                    | —                        | Any other `status`             |

<Note>
  When the state is missing or unrecognized, aciona.me treats the alert as a **trigger**. That is deliberate: over-notifying beats losing a real incident.
</Note>

## Auto-resolution guarantees

<AccordionGroup>
  <Accordion title="Recovery with no open incident" icon="ghost">
    No action. The alert is recorded, no incident is created and no error is returned.
  </Accordion>

  <Accordion title="Recovery for an already resolved or closed incident" icon="check-check">
    Idempotent. It does not reopen, modify or duplicate events.
  </Accordion>

  <Accordion title="Timeline record" icon="list-ordered">
    Auto-resolution records the event identifying the source that resolved it, with no human author.
  </Accordion>
</AccordionGroup>

<Card title="Auto-resolution troubleshooting" icon="life-buoy" horizontal href="/en/troubleshooting/no-auto-resolution" />