Event Orchestration Triggering Thresholds??

What’s with Orchestrations not having the granular “triggering thresholds” I have in basic event rules?

I need to tell a particular noisy alert to chillax and only create an incident after X amount of noise over a certain period.

:frowning:

Hi @matt.newman, you should have an Action Rule called “Depends on event frequency” in Event Orchestration, this replaces the triggering thresholds.

1 Like

Exactly as @constant.fischer says. The new Orchestration rules are a bit to adjust too from Event Rules but I, for one, am seeing some pretty neat potential with them. Where an Event Rule was all-in-one, you break the Event Orchestration down into steps.

So if you want a threshold on a specific alert based on content you would have content rule that would match against the alert and “Leave as is”. From there you can build addition rules off the first.

So one of mine, for example, is three branches:

  • Match content of alert - Leave as is (this gets us into a branch for the specific alert type)
    • If the alert has been seen 5 times in 60 minutes - Leave as is (this opens an incident)
    • Else
    • Match all alerts - Suppress alert (do not open an incident)

Biggest tradeoff I see to the additional overhead is that I can get very fancy with logic in PagerDuty instead of being restricted to the linear flow of Event Rules.

1 Like

Yep! Thanks guys! I see it now. Not sure how I passed that one up. I’d only nested once early on in my Orchestration testing and I wasn’t using nesting correctly at that time.