Alert Storm Insights

Alert Storm Insights detect and flag unusually high alert volumes to help identify events that may indicate a broader service outage.

Edwin AI automatically identifies an Insight as an Alert Storm when there are 100 or more alerts within a 15 minute window that meet one of the following criteria:

• The alerts include the same event name, event source, and tenant ID.
• The alerts include the same event CI and tenant ID.

When Edwin detects an Alert Storm, the Insight description displays Alert Storm Insight with details of the alert volume and source.

The insight also displays as an Alert Storm in the ML Result list to distinguish between the different types of Insights.

Any alert identified as part of an Alert Storm Insight functions the same way as a Correlation Insight. You can associate the alert with an ITSM ticket or run an AI Investigation against it.

Configuring Alert Storm Insights

1. Navigate to Edwin AI > Rules.
2. Select Edit to configure the Correlation processing rule.
   If you have modified or disabled this rule, edit your alternative processing rule.
3. Add a new Filter with the following parameters:
   • ML Source (ml.source)
   • Equals
   • alertStorm 
4. Select Submit.

Edwin now identifies Alert Storms when creating and updating Incidents.