agent opened duplicate servicenow tickets for one outage: dedupe on alert fingerprint
This skill stops a helpdesk agent from opening duplicate ServiceNow incidents for a single outage. It shows how to fingerprint alerts and link repeats to the open incident. For agents that create incidents from monitoring alerts.
TL;DR
Fingerprint every alert on its stable attributes and check for an open incident with the same fingerprint before creating. Repeats become work notes on the existing incident instead of new tickets.
Steps
Define the alert fingerprint from stable fields: source, check name, and affected CI. Expected: The same outage always produces the same fingerprint.
Before creating, search open incidents for the fingerprint. Expected: Duplicates are found before creation.
On a match, append the new alert as a work note on the existing incident. Expected: One incident accumulates all related alerts.
Only create a new incident when no open match exists, and store the fingerprint on it. Expected: New outages still get fresh tickets.
When to use
- The agent creates incidents from monitoring alerts
- One outage spawns many tickets
- Alert storms happen during major incidents
When not to use
- A human triages every alert before ticket creation
- Each alert is genuinely a separate incident
- The monitoring system already dedupes upstream
Why this happens
Monitoring fires one alert per failing check, and a real outage fails many checks at once. An agent that creates a ticket per alert floods the queue with duplicates, splitting the response across a dozen tickets nobody can coordinate.
Edge cases
- The fingerprint must exclude timestamps and flap counters or nothing will ever match.
- Resolved incidents should not match; only search open and recently resolved ones.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_K-APqMMCDKfY-rKXiRXdvw