1. From the Assignment group field menu, select the assignment group to determine which team’s alerts will trigger the automation.

   The Assignment group represents a specific team responsible for handling certain alerts. By selecting an assignment group, you ensure that only the alerts assigned to that particular team will trigger the automation. This way, the automation is targeted and only activates for relevant alerts associated with the selected team.

   Note:

   • If you’re logged in to the instance with an administrator role (evt_mgmt_admin), all of the assignment groups are available. Additionally, you can select All groups to enable generating alerts for any of the available groups.
   • If you’re an operator, only the group you’re a part of is available.
   • Only members of the selected group or administrators can update or delete the automation.
2. Set up the conditions by selecting the field, operator, and field value. Then, add more conditions using OR or AND operators. You must add at least one more filter besides the assignment group.
   Tip:

   Select a more specific filter to enhance performance.

   To add another set of conditions, select + New condition set. You can also manually add an additional info field if you don’t see it in the drop-down list.

1. In the Grouping timeframe field, specify the duration (in minutes) when alerts must be collected and grouped together.
2. In the Source field menu, select the source from which you want the alerts to be grouped.
   Note:

   You can manually add a field name and select the type of the field. The available options include additional info field, alert tag, and CI tag. This flexibility allows you to customize the information being captured according to your specific needs.
3. In the Match method for grouping field, select one of the following options: group alerts based on an exact match, fuzzy match, or pattern match.

   When you select a value for the fuzzy match method in the grouping field, the Similarity threshold (percentage) field becomes visible. Alerts are grouped when their similarity is greater than or equal to the specified percentage based on edit distance.

   For example, if you have alerts from USA, CA, and USA, NY, and you want to group the alerts by country, you would set the Source field to USA. If the Match Method for Grouping is a fuzzy match and the Similarity threshold (percentage) is 50%, then alerts will be grouped if they are at least 50% similar, meaning they share the country "USA" as a common attribute.

4. When you select a value for the pattern match method in the grouping field, the pattern matching field becomes visible. Alerts are grouped when the specified pattern matches. For more information, see Pattern matching.

   Use asterisks (*) in the search string to match any number of characters or a question mark (?) to match any single character. Everything else in the search string matches itself. For example, use "HTTP Error 5??" to match all HTTP 500 errors.

   To include additional fields for grouping, select + Add criteria.

1. In the Order field, enter the automation order.
   Note:

   Alerts are grouped based on the first match, executed in order from the lowest to the highest number. The Automation is managed by field displays the team or assignment group who owns, edits, and can delete this automation. The assignment group is the same as the one defined in the If these conditions are met section.
2. In the Automation description field, enter a brief description of the automation.

During the simulation, it shows both the grouped alerts and the ungrouped alerts for the specified timeframe. If any alerts are grouped, you are shown the number of alerts that are grouped. You can select this number to view the grouped alerts. Additionally, selecting an individual alert displays the details of that specific alert. You can also modify any alert grouping conditions or field values and initiate the process again by selecting Re-run test.

The Test Automation section displays three key columns: Description, Type, and Time. The Description column outlines the alert group details. Preceding the Description column, a number indicates the total alerts contained within that group. Type specifies the category of grouping, such as This grouping automation, Other grouping automation, CMDB group, or Single alert, among others. Selecting Other grouping automation directs you to the corresponding automation page that generated the group. Additionally, the Time column shows when the test was conducted.