Issue
The alert remediation subflow associated with an alert management rule fails to trigger when the alert description is updated through subsequent events.
Steps to reproduce:
- Create an initial alert event that updates the description with several data points.
- Verify this initial event triggers the remediation subflow based on the alert management rule.
- Confirm the subflow creates an incident with the initial description (containing a "nil" case ID value).
- Create a second event associated with this alert that includes a case ID value (for example., "12345665656").
- Observe that while this event updates the alert description, it does not trigger the alert remediation subflow.
Release
Any supported release
Cause
The automatic executions limit on alert management rule was set to 1. This setting restricts the workflow to run only once while an alert remains open. The counter resets when the alert is closed.
Resolution
- Open the Alert Management Rule configuration for the affected alert.
- Go to the Actions tab.
- Locate the Automatic executions limit field and change the value from one to a higher number, such as 100.
- Save the configuration.
Note: You can set this value to any number greater than 1 based on your specific requirements.