Alert Deduplication & Grouping

Regen prevents alert storms from creating hundreds of duplicate incidents. Two mechanisms work together: deduplication (same alert firing again) and grouping (different alerts that belong to the same incident).

Deduplication

When an alert arrives, Regen checks if an active alert with the same external_id already exists:

• Match found — Regen updates the existing alert (timestamps, annotations). No new alert or incident is created.
• No match — Regen creates a new alert and evaluates routing rules.

The external_id source depends on the integration:

Grouping Rules

Grouping combines multiple related alerts into a single incident. Configure under Settings → Grouping Rules.

Example: Group all alerts from the same service

Match labels:  service = payments-api
Group by:      service
Window:        5 minutes

If payments-api fires three different alerts within 5 minutes, Regen creates one incident and links all three alerts to it.

How it works

1. A new alert arrives
2. Regen checks active grouping rules in priority order
3. If a rule matches, Regen looks for an open incident that already has alerts matching the same group key
4. Match found — the alert is linked to the existing incident (no new incident created)
5. No match — evaluated against routing rules to determine whether to create a new incident

Grouping rule fields

Routing Rules

Routing rules control what happens after deduplication and grouping. Configure under Settings → Routing Rules.

Actions

Example rules

Create incidents for critical and warning alerts:

Match: severity IN [critical, warning]
Action: Create incident

Suppress info alerts during business hours:

Match: severity = info
Action: Suppress

Rules are evaluated in priority order. The first matching rule wins.