Automatically create an incident with incident rules

Incident rules let you customize how your incidents are created. If the alert data matches the conditions you defined, Opsgenie automatically creates an incident based on the defined fields. Like many Opsgenie engines, the incident rules operate on If/Then statements and matching conditions.

Opsgenie's integration rules automatically process incoming data, create a new alert, and forward the alert data to the incident management rule engine. If the alert data matches specified conditions (Incident Rules), Opsgenie creates an incident and associates the raw alert with the incident (in a parent-child relationship).

To create an incident automatically with an incident rule;

1. Go to Teams from the main menu,

2. Select a team,

3. From the team menu, select Incident rules,

4. Select Create incident rule,

5. Set the type of alerts you you’d like to match to this rule from Set conditions for the incident rule,

6. Set the properties of the incident Opsgenie should create when the alert is matched from Set incident properties,

7. If you wish to send notifications to stakeholder with the incident created, set the details from Stakeholder properties,

8. Select Create.

A team can have maximum 200 incident rules.

Later, you can drag and drop the rules to change the incident rule order. Opsgenie will create the incident on the first rule it matches the alert.

The automatically created incident notifies the responders and the stakeholders of the selected impacted services, according to communication channels specified by users or by any notification template. Learn more about the notification templates.

After you close the incident, and if Opsgenie matches a new alert with an incident rule, it will open a new incident and send new notifications.

Auto-matched alert behavior

After an incident is opened, alerts matching the incident rules automatically become associated alerts of that incident. Opsgenie doesn’t send alert notifications for these alerts. This aims to reduce alert fatigue. Learn more about associated alerts.

If an alert automatically matches an incident because of an incident rule, after the incident status is resolved, the incident status will be changed from resolved to reopened.

Therefore, it is important to close your incidents in a timely manner, because notifications are not sent for alerts matching an open incident.