Alert assignment rules are the native, configuration-based method for routing and controlling alerts based on conditions like CI groups. They can assign to groups, and the group’s membership dictates who can acknowledge. This is more maintainable and aligned with best practices than custom scripting (option 2/3) or UI Policies (option 4) which don’t inherently manage permissions.

For correlation to work, events must share a common identifier in the field(s) specified in the correlation definition (e.g., same node, same interface). If these key fields are empty or different, the Correlation Engine cannot group them, resulting in a null Correlation ID. While other options could prevent correlation, the absence of a Correlation ID points directly to a failure to match on the defined correlation keys.

You would create a business rule on the Alert table that triggers on update of the related incident field. This rule would check if the incident state is resolved AND if the alert’s CI belongs to an application service class (via the CI’s class or a custom attribute). This logic requires understanding both the Alert/Incident relationship (Business Rule) and the CI’s classification (CMDB CI Class).

The ECC Queue is a core component of the MID Server architecture. Its specific role is to handle the bidirectional flow of work: it holds commands (like probe requests) sent to the MID Server and queues the results or captured events coming back from the MID Server before they are processed by the Event Management engine.

Formula conditions use logical AND (&&). For the entire condition to be TRUE, both clauses must be TRUE. While the first clause (`source CONTAINS ‘router’`) is TRUE, the second clause (`severity > 3`) is FALSE (2 is not > 3). Therefore, the overall result of `TRUE && FALSE` is FALSE.

A Report Source on the Alert table allows you to create a standard, grouped report. You can group by the CI’s class (e.g., using `cmdb_ci.sys_class_name`), count the alerts, sort descending, and set a row limit to 5. This uses the platform’s native reporting engine, is performant, and can be scheduled or put on a dashboard.

A Probe is an active monitoring component. It is a script or command executed by a MID Server to actively poll or query an external system (like a server, database, or API) to check its state or retrieve metrics. The results are sent back as events. This contrasts with a Sensor (option 2), which is passive.

The ‘Alert Priority’ mapping within the Alert Settings section of an event rule is the direct configuration point for setting the priority of the created alert. This mapping can be static (e.g., always set to 1 – Critical) or dynamic based on event fields. Checking this first is the most targeted step.

A key benefit of Flow Designer is its visual workflow interface. This makes automation logic more accessible to process owners and administrators who may not be skilled in JavaScript. It promotes collaboration and maintainability, which is a practical advantage in many enterprise environments, even though Business Rules and IntegrationHub spokes can also achieve similar technical outcomes.

Alert assignment rules are the native, configuration-based method for routing and controlling alerts based on conditions like CI groups. They can assign to groups, and the group’s membership dictates who can acknowledge. This is more maintainable and aligned with best practices than custom scripting (option 2/3) or UI Policies (option 4) which don’t inherently manage permissions.0