# Unified Alert Grouping

Combine Intelligent Alert Grouping's machine learning model with Content-Based Alert Grouping's precision

Unified Alert Grouping combines [Content-Based Alert Grouping](/ai-automation/aiops/noise-reduction/alert-grouping/content-based-alert-grouping) and [Intelligent Alert Grouping](/ai-automation/aiops/noise-reduction/alert-grouping/intelligent-alert-grouping) with a flexible time window for increased precision and correlation control. Unified Alert Grouping groups alerts when alert content matches and Intelligent Alert Grouping determines alerts are similar. Alerts group only when both conditions are satisfied.

> **AIOps / Signal Intelligence Feature:** This feature is included with the [PagerDuty AIOps](/ai-automation/aiops/overview) add-on, or included as Signal Intelligence in PD Reliability Platform plans. To sign up for a trial of PagerDuty AIOps features, read [PagerDuty AIOps Trials](/ai-automation/aiops/overview#pagerduty-aiops-trials).

> **AIOps Service Configuration:** Your service configuration must have AIOps enabled to use this feature. AIOps Service Configuration is in Limited General Availability — see [Configurable Service Settings](/incident-management/services/configurable-service-settings#manage-aiops) for more information and enablement steps.

> **Required User Permissions:** Users with the following roles can edit a service's Alert Grouping settings:
>
>   - Account Owner
>   - Admin and Global Admin
>   - User
>   - Manager base role and Team roles

## Enable Unified Alert Grouping

1. Navigate to **Services**  →  **Service Directory** and select the name of your desired service.
2. Select the **Settings** tab and click **New Grouping** in the section **Reduce Noise**.
3. Select **Intelligent + Alert Content**.
   1. _Optional_: To group alerts across multiple services, select additional services in the dropdown **Select Services to group the alerts**. Read [Global Alert Grouping](/ai-automation/aiops/noise-reduction/alert-grouping/global-alert-grouping#intelligent--alert-content) for more information.
4. Select whether you want alerts to be grouped if **All** or **Any** specified fields match.
   1. If **All** is selected, alerts match when content is exactly the same.
   2. If **Any** is selected, alerts match when at least one of the fields is present.
5. In the **Select Fields** dropdown, select which alert field you would like to match on before Intelligent Alert Grouping considers alerts' similarity.

> **View Alert Payloads:** You can select fields from recent alerts by clicking **See Recent Alerts**. This displays a list of the service's recent alerts. You can click an alert to view the alert's payload and then click on the field you want to match on.

6. _Optional_: Click **Add Field** to add additional content-based matching criteria.
7. Select the desired grouping time window for alerts on the service. The **Recommended** time indicated in the dropdown uses historical service data to calculate the average time between alerts.
8. Click **Save Settings**.

## Disable Unified Alert Grouping

To select a different grouping method, or to disable Alert Grouping altogether, in the web app:

1. Navigate to **Services**  →  **Service Directory** and select the name of your desired service.
2. Select the **Settings** tab and click **Edit** next to **Reduce Noise**.
3. In the bottom-left, click **Delete**.
4. In the confirmation modal, click **Yes, turn off**.

## Unified Alert Grouping Behavior

Consider the following alerts:

**Alert 1**
`Summary: “High CPU load on AWS EC2 instance”
custom_details.source:”Datadog”`

**Alert 2**
`Summary: “High CPU load on AWS EC1  instance”
custom_details.source:”Splunk”`

[Intelligent Alert Grouping](/ai-automation/aiops/noise-reduction/alert-grouping/intelligent-alert-grouping) by itself would likely detect these two as similar, and group them together. However, with the greater control that Unified Alert Grouping offers, you can specify that alerts should only group if `custom_details.source` matches.

As another example, in the following configuration, Unified Alert Grouping specifies that the `host` must match before Intelligent Alert Grouping considers alerts for grouping.

![Alerts must match on `custom_details.host`](/images/kb/9cc28b1c4c6ffc6dbe52aa0e1ddbfbb2ca0e8bcb4ab526c29e5f7265509c6b44-unified-alert-grouping-host.webp)
*Alerts must match on custom\_details.host*

The incident in the following screenshot shows that the host name matched, and that the summary fields were similar enough for Intelligent Alert Grouping to group them together.

![Alert grouping result](/images/kb/57377036443f47f28526c3fed76d2e3fc15747f04483f344563dc552acdada31-grouped_alerts.webp)
*Alert grouping result*

<br />