Process incoming incidents from your integrations before they escalate to your teams and on-calls. Give each integration its own escalation policy to route, silence, or filter alerts based on their metadata, then hand the real incidents off to the right team's escalation policy.

How it works

When an integration creates an incident, the incident runs through the escalation policy assigned to that integration. By giving each integration a dedicated processing policy, you can:

• Route the incident to the relevant team's escalation policy.
• Discard noisy or irrelevant alerts.
• Immediately resolve non-actionable alerts while keeping a record.
• Create an incident without notifying anyone, just to track its status.

Create an escalation policy per integration

1. Go to Escalation policies and click Create escalation policy.
2. Name it after the integration it processes, for example Datadog alert processing.
3. Add the steps that decide what happens to each incoming incident, as described below.
4. Assign the policy to the integration.

Keep processing policies tidy in a group

On the Escalation policies page, create a group such as Integration alert processing and move your per-integration policies into it. This keeps them separate from your teams' on-call escalation policies.

Route incidents to the right team

Add a time-based or metadata-based step, choose escalate to another escalation policy, and select and stop this escalation policy. This hands the incident from the per-integration processing policy to the team's real on-call escalation policy.

Process incidents with metadata steps

Add a metadata-based step to act on incidents based on their metadata, such as severity, service, or ownership. For each value you match, choose one of the following actions. You can read more about metadata in Metadata in escalation policies.

Discard the incoming incident

Choose Remove this incident to drop the alert entirely. Use this to prevent noise from irrelevant alerts.

Immediately resolve the incident

Choose Resolve this incident to open and immediately resolve it. No one is notified, but the incident is kept so you can inspect it later. This is great for non-actionable alerts you still want a record of.

Create the incident without a notification

Choose Do not escalate to create the incident without notifying anyone. The incident is created as Ongoing and updated to Resolved automatically based on the integration. You can also acknowledge and resolve it manually. Use this to track the status of actionable incidents without getting notified.

Assign the policy to the integration

Open the integration's settings, select Escalation policy, and pick your processing policy under Choose escalation policy or create a new one.

See which integration uses a policy

On the Escalation policies page, open the Resources tab to see where each policy is used, including the integrations. From there you can open the integration or switch it to a different policy.

Need help?

Please let us know at hello@betterstack.com.
We're happy to help! 🙏