Skip to main content

​
Context

When multiple alerts are received with the same deduplication key, incident.io groups them together within a specific time window. This grouping window works is important for managing ongoing incidents, especially those that span longer periods.

​
Answer

Alert grouping in incident.io works with a rolling 48-hour window. The grouping functionality works as follows:
  • Alerts with the same deduplication key will be grouped together if they arrive within 48 hours of the most recent alert in the group
  • The 48-hour window is rolling, meaning it resets each time a new alert in the group is received
  • If a new alert arrives after the 48-hour window has expired, a new incident will be created
If you need to track updates beyond the 48-hour window, you may need to consider alternative approaches such as:
  • Creating a separate alerts route with different grouping rules
  • Using the incident.io API to update incident summaries programmatically