For integrations which generate repeated intermittent alerts, there’s a need to associate the multiple alerts according to basic criteria. For example, a web server with repeated traffic spikes may produce multiple alerts per hour, each resolving in a few minutes. Once these alerts pass a defined threshold, one incident should be created linking the related alerts. Pseudo logic would resemble:

IF COUNT(alias = 1234) > 5 AND createdat < 60m THEN create incident

Currently there is no way to aggregate or coalesce multiple alerts, and alert automation lacks support for fields which would make this possible. Support for this feature assists teams juggling numerous similar alerts from interconnected systems where a single problem causes alerts on downstream components.