We have a job that periodically (every 10 minutes) scans our systems and reports error codes; if there are any errors, it creates an email and sends it to PD. Since we want to be alerted if a new error comes up, but not if the error code is the same as an already open incident, we use an alert key regex for the email that grabs the error codes from the email body.
Our question is the best way to automatically resolve incidents once the errors are fixed. If our job detects no errors, it will send an all clear email that we would like to use to resolve all open incidents. We don’t track the error codes that have been sent so this all clear does not contain any string that can easily be mapped to the alert codes of the open incidents. What’s the best way to have a resolve rule that will resolve all open incidents (or all incidents whose email matches a subject or on something different than the alert key)?