Intelligent Alert Grouping

Intelligent Alert Grouping automatically consolidates related alerts into a single, actionable incident, using machine learning to reduce alert noise for DevOps teams and SREs. Instead of managing dozens of separate notifications, incident responders can focus on problem-solving while the system combines related alerts in real time. The technology continuously learns from your team's response patterns and service behavior, becoming more accurate over time and leading to progressively faster incident resolution.

Enable Intelligent Alert Grouping

1. Navigate to Services Service Directory and select your desired service.
2. Select the Settings tab and click New Grouping under Reduce Noise.
3. Select Intelligent.
   • Optional: To group alerts across multiple services, select additional services in the Select Services to group the alerts dropdown. See Global Alert Grouping for more information.
4. Select the desired grouping time window for alerts on the service. The Recommended time window in the dropdown uses historical service data to calculate the average time between alerts.
5. Click Save.

View Intelligent Alert Grouping on an Incident

You can see Intelligent Alert Grouping actively grouping alerts on an incident's detail page under the Alerts tab. The Grouping Now label indicates that an incident is using alert grouping. You can also see how many alerts are grouped into the incident and their status. In the example below, two alerts have been grouped: one is triggered and the other is resolved.

Select Alert grouping details to see which Alert Grouping method is in effect, when grouping started, and the conditions under which grouping stops.

Disable Intelligent Alert Grouping

To select a different grouping method or disable Alert Grouping entirely:

1. Navigate to Services Service Directory and select your desired service.
2. Select the Settings tab and click Edit next to Reduce Noise.
3. Click Delete in the bottom-left corner.
4. Click Delete in the confirmation modal.

Advanced Options

Advanced Options allow you to customize which alert fields the grouping model analyzes when determining textual similarities, and to reset the grouping model's learner cache.

• Configure Grouping Fields: Choose up to five fields, including standard Common Event Format (PD-CEF) fields and custom details, for a comprehensive alert grouping analysis.
• Reset Learner Cache: Reset the learner cache.

Configure Grouping Fields

By default, Intelligent Alert Grouping uses alerts' Summary field to determine textual similarity. Depending on your event data, you may want to use alternate fields to determine similarity.

1. While configuring Intelligent Alert Grouping, click the Advanced Options dropdown.
2. Under Select Fields, select a field from the dropdown for the Intelligent Alert Grouping model to consider for textual similarity.
   • If you select Custom Details, enter a Custom field name.
3. Optional: Click Add Field and select another field. You can repeat this step to configure up to five fields.
4. Click Save.

Reset Learner Cache

This option resets the grouping model's learner cache. This can be useful if a service's data structure changes significantly or after a period of testing.

1. While configuring Intelligent Alert Grouping, click the Advanced Options dropdown.
2. Enable the Reset learner cache checkbox.
3. Click Save.

Algorithm Behavior

The Intelligent Alert Grouping algorithm observes real-time alert data and incident history and adapts as new alerts trigger on a service. After you have enabled Intelligent Alert Grouping on a service, no explicit configuration is required, though you may optionally configure the Flexible Time Window.

Intelligent Alert Grouping groups an alert into an existing incident when all of the following criteria are met:

1. The most recent alert was created within the specified grouping time window. This works on a rolling basis — the timestamp on the incoming alert is compared to the most recently grouped alert.
2. The incident is less than 24 hours old.
3. The Intelligent Alert Grouping algorithm determines that the alerts are similar.

Alerts that do not meet these criteria trigger a new incident.

The algorithm also reacts to feedback from you and your team. The best way for the algorithm to learn and adapt is to manually merge related incidents and to manually move alerts to a different incident when they are not related. See Merge Incidents for more information. Alert titles can also be updated automatically using Event Orchestration, which influences the algorithm.

PagerDuty strongly recommends against sending test data to try to influence the algorithm, as this can result in unpredictable behavior.

Flexible Time Window

You can configure the grouping time window on each service. The Recommended time window is calculated from the average time between alerts using historical service data. The larger the grouping time window, the higher the chance of overgrouping — where an unrelated alert is grouped into an incident. After increasing the time window, monitor alert grouping on the service for a period of time and adjust as needed based on accuracy.

FAQ