Alert Correlation

Alert correlation is a method of grouping alerts into one high-level incident. This allows you to better understand the relationships between alerts from multiple sources that occur within the IT environment, eliminate wasted/duplicate efforts by different teams on the different alerts that are part of the same incident, and determine which ones are most relevant, important and that need to be investigated. The output from alert correlation is an incident.

BigPanda alert correlation engine clusters high-quality alerts into actionable incidents by looking at 4 properties:

• Source System
• Tags
• Time Window
• Filter (optional)

As new alerts are received, BigPanda evaluates all matching patterns, and determines whether to update an existing incident or create a new incident. With this powerful algorithm, BigPanda can effectively and accurately correlate alerts to dramatically reduce your monitoring noise by as much as 90 – 99% in some environments. Correlations occur in under 100ms so you see updates in real time for maximum visibility into critical problems.

You can customize correlation patterns to tailor alert correlation to the specifics of your infrastructure. Learn more about customizing alert correlation in the Manage Alert Correlation documentation.

Understanding how BigPanda determines which events are correlated into an alert and which alerts are grouped together into incidents can help you configure and use BigPanda more effectively. Particularly if you are using the Alerts Rest API to develop a custom integration or the correlation editor to modify a correlation pattern. Learn more about the way BigPanda correlates alerts together in the Alert Correlation Logic documentation.