Incident Correlation Engine
Learn how the Strata Cloud Manager incident correlation engine groups related alerts
into incidents to reduce noise and streamline your response.
| Where Can I Use This? | What Do I Need? |
|---|
|
|
- One of the following licenses:
|
Strata™ Cloud Manager uses an incident correlation engine to analyze related
network alerts and group them into a single consolidated incident. This reduces alert
noise and fatigue and keeps notifications aligned with how you respond. For example,
when a tunnel failure causes a Border Gateway Protocol (BGP) session to drop, Strata
Cloud Manager reports the tunnel failure as the incident and includes the BGP session
drop as a related symptom. You don't get a separate notification for each.
The engine uses the relationships between connected infrastructure to group
related symptoms under the incident for the underlying issue, regardless of which alert
arrives first. To allow time for related alerts to arrive, the engine evaluates new
incidents for a short period before raising them and sending notifications. This
evaluation period also applies to incidents with
custom
thresholds and can contribute to the overall time before an incident is
raised or a notification is sent.
The correlation engine provides the following capabilities and timing
behaviors:
Noise reduction: Groups cascading or duplicate events across
connected infrastructure under a single incident for the underlying issue. This
prevents alert fatigue and makes troubleshooting simpler.
Notification timing: Strata Cloud Manager raises an incident and
sends notifications after a short evaluation window. The length of the window
depends on the incident type. When custom thresholds are configured, the
correlation evaluation window might introduce additional time beyond the
configured threshold before the incident is raised and notifications are
sent.
Late-detected underlying issues: If Strata Cloud Manager has
already sent a notification for a symptom before it detects the underlying
issue, the symptom's incident is linked under the incident for the underlying
issue.
Transient issue suppression: If the underlying condition
resolves within the evaluation window, Strata Cloud Manager doesn't raise an
incident or send a notification.
