Intelligent Alert Grouping

Automatically add incoming alerts to related open incidents via the Intelligent Alert Grouping algorithm

Intelligent Alert Grouping uses a real-time, machine learning-based algorithm to group related alerts into a single, open incident. This is particularly helpful for incident responders, as it reduces the amount of noise they must contend with and allows them to focus on the task at hand. Over time, the grouping algorithm will adapt to understand new types of alerts and react to human behavior, thereby improving the accuracy of its grouping decisions and further reducing incident resolution times.

📘

Note

This feature is available as part of the Event Intelligence package or on Digital Operations plans. If you would like to sign up for a trial of Intelligent Alert Grouping and other Event Intelligence features, please contact our Sales team.

🚧

Required User Permission

Users with the following roles can edit a service’s Alert Grouping settings:

  • Account Owner
  • Admin and Global Admin
  • User
  • Manager base role and team roles
    • Manager team roles can only manage services associated with their team.

Enable Intelligent Alert Grouping

📘

Prerequisite

In order to be eligible for Intelligent Alert Grouping, a service must have alerts enabled. If the service is configured to only create incidents, the Intelligent Alert Grouping option will not be available. Read more about enabling alerts on a service in the Alerts article.

To enable Intelligent Alert Grouping:

  1. Navigate to Services Service Directory select the name of your desired service.
  2. Select the Settings tab and click Edit next to Reduce Noise.
  3. Select Intelligent.
  4. Click Save Changes.
20122012

Intelligent Alert Grouping on a recommended service

View Intelligent Alert Grouping on an Incident

When enabled, you can see Intelligent Alert Grouping actively grouping alerts on an incident’s detail page under the Alerts tab. The Grouping Now label indicates that an incident is using alert grouping. You can also see how many alerts are grouped into the incident, as well as their status. In the example below, two alerts have been grouped: one is triggered and the other is resolved.

911911

View Intelligent Alert Grouping

Select Alert grouping details to see which grouping method is in effect (Intelligent, Content-Based or Time-Based Alert Grouping), when grouping started, and the conditions when grouping will stop.

533533

Alert grouping details

Disable Intelligent Alert Grouping

To select a different grouping method, or to disable Alert Grouping all together, in the web app:

  1. Navigate to Services Service Directory select the name of your desired service.
  2. Select the Settings tab and click Edit next to Reduce Noise.
  3. Select the desired grouping method or Turn Off Alert Grouping.
  4. Click Save Changes.

Algorithm Behavior

The Intelligent Alert Grouping algorithm is built to observe real-time alert data and incident history, and adapt as new alerts trigger on a service. No explicit configuration is necessary, other than enabling Intelligent Alert Grouping on a service.

Intelligent Alert Grouping will only group an alert if the prior alert was created within the last 5 minutes and is deemed similar; new alerts outside of the five minute window will not be grouped. Also, Intelligent Alert Grouping will only perform grouping of alerts into incidents that have been open for less than 24 hours. After 24 hours have elapsed, future alerts will be grouped into a newly created incident.

The algorithm also reacts to feedback from you and your team — the best way for the algorithm to learn and adapt to new grouping behaviors is to manually merge incidents that are related, and to manually move alerts out of incidents when they are not related. For more information about moving alerts from one incident to another, see this Knowledge Base article. Alert titles can also be updated automatically using event rules, which influences the algorithm.

📘

Note

Merging/unmerging alerts through the API will not factor into the Intelligent Alert Grouping algorithm. Only manual merges and unmerges influence the algorithm.

The algorithm interprets and adjusts to new alert data or behavior on a service quickly. We strongly recommend against sending in test data to try and influence the algorithm, as this can result in unpredictable behavior.

FAQ

Can we expose the machine learning-based model via the API?

Expand

No, not at this time.

Can we plug our own machine learning code into PagerDuty?

Expand

No, not at this time.

Does this take into account some of the rules or correlations we have configured outside of PagerDuty?

Expand

No, this model is entirely based on actions taken within PagerDuty.

Does it affect the machine learning capabilities if I rename the service?

Expand

No, it does not.

Can Intelligent Alert Grouping group alerts together from multiple services?

Expand

Intelligent Alert Grouping only looks at alerts from a single service. If you want alerts from different services to be grouped, you may need to reconfigure your service so that all related alerts are sent to the same service. If responders would like more context on incidents happening across other services, please read our article on the Related Incidents feature.

Why didn’t my alerts get grouped together?

Expand

There are three main reasons the Intelligent Alert Grouping algorithm may not have grouped alerts on the same service:

  1. The alerts weren’t close together in time. Intelligent Alert Grouping will consider grouping new alerts into open incidents that have had an alert grouped within the last 5 minutes.
  2. The incoming alert data was not similar enough to desired alerts or was more similar to the alerts it was grouped with.
  3. Human response behavior via merging or moving alerts out of incidents overrode the desired behavior.

The Intelligent Alert Grouping algorithm takes into consideration several different factors, which makes understanding why alerts are grouped or not difficult to trace. If you believe that there has been enough history for an alert to be grouped, but are still noticing some unexpected grouping behavior, please reach out to our Support team and send links to specific incidents/alert groupings and summarize why the grouping behavior is unexpected.

Why don’t I see any alert grouping options?

Expand

There could be a few reasons why you don’t see any options for Alert Grouping:

  • If you do not see an one option for automatic grouping:
    It’s possible your current pricing plan does not support Alert Grouping. If you are interested in trying Alert Grouping, contact our Sales team to start a free Event Intelligence trial.
  • If you see a message that the service is configured for incidents only:
    This means that your service is able to create alerts, but it is not configured to do so. Please see Alerts for more information about how to adjust this behavior on a service.
  • If you see a message that the service has integrations that do not support alerts:
    Some monitoring tools do not support creating alerts, and therefore any services with these tools integrated will not be able to take advantage of Alert Grouping. To enable alerts on a service, you need to remove the integration that does not support alerts. For a list of integrations that do not support alerts please see this article.

Is there a limit to how many alerts can group into a single incident?

Expand

Yes, incidents are limited to 1000 alerts each. After this limit is reached, a new incident will be created and subsequent alerts will be grouped into the new incident.

Are incidents resolved only when all alerts within that incident are resolved?

Expand

Yes, that is correct. An incident will resolve when all of its associated alerts are resolved. Similarly, if you resolve an incident, PagerDuty will automatically resolve any associated, triggered alerts. For more information, please see Resolve Alerts.


Did this page help you?