Open YulNaumenko opened 3 years ago
Based on the team discussion, was decided to solve the problem in two steps:
Based on the research from @arisonl, competitors have a support for Resolving incidents for ServiceNow, Jira or IBM Resilient
Rename title to Ability to resolve ServiceNow, IBM Resilient and Jira incidents
. We can use this issue to find a way to resolve IBM Resilient, Jira and SerivceNow incidents. If deduplication is the way to go, we'll handle it at the same time.
Moving from 7.12 - Candidates
to 7.x - Candidates
.
Moving from 7.x - Candidates
to 8.x - Candidates (Backlog)
after the latest 7.x planning session.
Pinging @elastic/security-threat-hunting-cases (Team:Threat Hunting:Cases)
Pinging @elastic/response-ops (Team:ResponseOps)
Where is that currently at? We have Elastic Cloud and Jira Service Management, and we currently lack the ability to auto-resolve incidents.
PR https://github.com/elastic/kibana/pull/171760 implemented auto-closing SN incidents when an alert recovers.
cc @shanisagiv1
It would be great to leverage the new recovered action group to make alerts resolve certain types of incidents when they recover. There is currently no way to deduplicate incidents in ServiceNow, Jira and IBM Resilient to find the right incident to resolve. If there could be something similar to PagerDuty, that would be great.
Original description
In the [issue](https://github.com/elastic/kibana/issues/77772) we are changing the grouping field for ServiceNow, Jira and IBM Resilient from {{alertId}} to {{alertInstanceId}}. But there is no similar way as for PagerDuty to avoid duplication of incident creation. We need to do an API call to check if the incident for a current alertInstanceId was created. Similarly there is no way to Resolve created incidents as we do for PagerDuty. ServiceNow, Jira and IBM Resilient requires to do a separate API call with the existing incident Id to change the status to Resolved. Do we planning to support Deduplication and Resolve mechanism for ServiceNow, Jira and IBM Resilient with the current limitations?