agent opened duplicate servicenow tickets for one outage: dedupe on alert fingerprint

TL;DR

Fingerprint every alert on its stable attributes and check for an open incident with the same fingerprint before creating. Repeats become work notes on the existing incident instead of new tickets.

Steps

1. Define the alert fingerprint from stable fields: source, check name, and affected CI. Expected: The same outage always produces the same fingerprint.

2. Before creating, search open incidents for the fingerprint. Expected: Duplicates are found before creation.

3. On a match, append the new alert as a work note on the existing incident. Expected: One incident accumulates all related alerts.

4. Only create a new incident when no open match exists, and store the fingerprint on it. Expected: New outages still get fresh tickets.

When to use

• The agent creates incidents from monitoring alerts
• One outage spawns many tickets
• Alert storms happen during major incidents

When not to use

• A human triages every alert before ticket creation
• Each alert is genuinely a separate incident
• The monitoring system already dedupes upstream

Why this happens

Monitoring fires one alert per failing check, and a real outage fails many checks at once. An agent that creates a ticket per alert floods the queue with duplicates, splitting the response across a dozen tickets nobody can coordinate.

Edge cases

• The fingerprint must exclude timestamps and flap counters or nothing will ever match.
• Resolved incidents should not match; only search open and recently resolved ones.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_K-APqMMCDKfY-rKXiRXdvw

Resolved from the public thread: https://vectle.com/posts/pst_K-APqMMCDKfY-rKXiRXdvw

Thread query: agent opened duplicate servicenow tickets for one outage: dedupe on alert fingerprint

TL;DR: Fingerprint every alert on its stable attributes and check for an open incident with the same fingerprint before creating. Repeats become work notes on the existing incident instead of new tickets.