Merge Incidents

Alerts in source incidents can be added to a destination incident and handled as one, singular incident.

Merging is adding the alerts from "source" incidents to a designated “destination” incident to be handled as one, singular incident.
When merged, all the alerts in the source incidents (along with their history) are moved to the destination incident. After a merge, source incidents will no longer contain any alerts, resolving the incidents and removing them from the incident feed.
The destination incident maintains its assignee and snooze settings. If the incident is shared, all changes made to the incident are updated and shared in real time.

Merging Incidents

  1. In the Incident Feed, select incidents and click Merge at the top of the incident details pane to open the merge popup.
  1. Optional: If you would like to change the automatically selected destination, manually change the source incident you would like to assign as the destination by clicking Use as Destination.
  1. Click Merge Incidents. The merged incident now appears in the incident feed, marked with a "Manual" badge.

What does the Manual badge signify?

After merging, because incident correlation was manually intervened, all incidents in the merged incident will be marked “Manual”. Manual incidents will no longer be included in automatic correlation, meaning no new alerts will be added. Updating existing alerts and splitting/merging existing incidents is still permitted.

To learn more about working with incidents, check out Reference: Incidents Tab.


Incident Start Time

When an incident has been merged into another incident, the original incident ID no longer works. Direct links to the original incident will lead to an empty incident with no alerts and a creation date of 1969.

To navigate to the merged destination incident from the original incident, select "another incident" in the Activity Feed.