use case: sandbox incident status

[00041275]

Help me solve the problem via keep. I have alerts coming from 500 servers using Zabbix. The truth is that I don't care until 50% of them go down. I don't need to create an incident until alerts appear on 250 servers. In general, what is the best way to proceed in a case when you have alerts, if some kind of sandbox for waiting for the threshold of sufficiency for an alert to be recalculated? Maybe some kind of sandbox status will appear in the incident by correlation that does not require action?

[shahargl]

Mmm that’s interesting use case.

We have the concept of “incident candidate” which is the case where you “maybe” eventually have an incident but maybe not.

maybe we can extend it to the threshold use case

[00041275]

ncident candidate

Where is it status?

[00041275]

How to use "Incident-candidate", where I need it fire? in doc, I can't understand how to use it in practice.

[shahargl]

its not a "status" but kinda boolean (incident candidate is either true/false). its a whole different table. I think it will be better to demo it or smth.

[00041275]

its not a "status" but kinda boolean (incident candidate is either true/false). its a whole different table. I think it will be better to demo it or smth.

What about to add status "Candidate" and may be threshold for firing status (of course workflow can set threshold) ? users can't see this boolean and look to firing status. Actually users haven't option for work with incident presets, and more usable filters. For filters/preset feature, will be great if we can enrich new data when correlate.