Incidents raised by AIOps should raise or lower priority if later Alerts meet the requirements to do so

Operations teams expect that the priority of Incidents generated and reported by AIOps to reflect the current priority of the underlying issue, not the priority of the issue at the time of Incident creation.

Currently, an Incident is raised at a specific priority determined by the criteria specified at the time of creation. If later Alerts are grouped into the incident that would be expected to increase the priority (for example a "warning" incident regarding loss of redundancy later being grouped with an Alert indicating actual service failure), then the incident's priority should similarly be escalated.

Policy execution explicitly states "no Incident will be created if the new/changed Alert is already grouped into an Incident". This prevents the behaviour above - either by forcing creation of a newer Incident (at higher priority) or by escalating the existing Incident when the later Alert comes in.

Idea priority

Urgent

Post comment

Guest

Oct 22, 2026
This also affects the Hold On condition. An incident policy can have multiple IF conditions, for example:
1. If 1 Critical alert → Hold On 5 min
2. If 2 Major alerts → Hold On 15 min
In a real scenario, we receive 2 Major alerts first, followed by 1 Critical alert. The incident’s story is built on the first matching condition (2 Major) and doesn’t re-evaluate when the Critical alert is grouped in. As a result, the incident keeps waiting the full 15 minutes instead of switching to the 5-minute Hold On that the Critical alert should trigger.
So the issue impacts both the Hold On timing and the priority (P#) of the incident, not just the priority at creation.
Rather than creating separate incidents, we’d expect a hierarchy of conditions within the same incident: when a newly grouped alert matches a higher-severity condition, the incident should re-evaluate and apply the more urgent Hold On and priority. An alternative would be to track parallel stories within the same incident based on each IF condition, with the most severe one taking precedence.
Reply
Hide replies

By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.

Shape the future of IBM!

Search existing ideas

Post your ideas

Specific links you will want to bookmark for future use

Incidents raised by AIOps should raise or lower priority if later Alerts meet the requirements to do so

Please enter your email address

RELATED IDEAS

Incidents raised by AIOps should raise or lower priority if later Alerts meet the requirements to do so