Intelligent Grouping - post Acknowledged alerts

We’re having issues with grouping where it groups new alerts to an already Acknowledged alert. We definitely do not want new alerts to go into an existing Acknowledged alerts.

We’ve confirmed that Intelligent grouping groups alerts upon initiation of the alert, which makes sense. Although it shouldn’t group after alerts are sitting in Acknowledged, correct?

Can someone at least confirm Intelligent grouping groups alerts “after” Acknowledgment or not? Grouping “after” Acknowledgment doesn’t make much sense.

How do we disable this if it actually does this? Our only other action is to turn off intelligent grouping.

Thank you

Hi Larry,

When Intelligent Alert Grouping is turned on for a service, it will automatically group incoming alerts to related open incidents. If you have not resolved an incident, then the alert grouping would still be possible.

You have the option to discontinue Alert grouping on a service. You can then manually merge incidents that you want grouped together. If you wish to stop the Alert Grouping, then you will just need to visit your service’s page and selecting Settings. Once there you can turn off Alert Grouping.


Abbott B
Technical Support Specialist

@abbott Thanks for your reply!
What we’re hitting now as an issue is that since IG is set to group alerts within 5 minutes of the last related alert, so it keeps on grouping. This could possibly go on indefinitely if we keep having related alerts.
Consequently, acknowledged alerts can have alerts grouping for a long time without us knowing unless we explicitly look.
What do you think we could do about this?
Time based grouping does the same thing, correct?
Content based is tough b/c it will group for 24 hours unless we get it perfect.
We’ve now had to turn IG off because of this issue. :frowning: What do you think?
Thank you

Hey Larry,

I understand your concern here about continued grouping into acknowledged alerts. There isn’t a way to turn this off. IG will group regardless of whether the existing incident is acknowledged or not. The intelligent grouping system is a learning system, however, so you might be able to train it away from this behavior by ungrouping previously grouped alerts. It will learn on responder behavior, and this could stop the post-ack grouping, but without a previous similar use-case where a customer has successfully done so, I can’t guarantee it.

Your best bet at this time, if you don’t wish to try training the grouping over the next few weeks is to turn it off. I’m happy to enter a feature request with our product team around your requirement that grouping not occur once an incident has been acknowledged. Can you tell me a bit more about your specific use-case and how making this change would ease a pain point for you? I would like to include it in the feature request. If explaining this would require you reveal information that you would rather not have on this public forum, you can write in directly to us at and reference this ticket number: #347868.

I look forward to hearing from you.