Alert Correlation

Definition

Alert correlation groups related notifications into an incident or investigation using shared scope and grouping rules.

Signals

• Metrics
• Events
• Alerts

Why use it

Reduce duplicate pages when one dependency failure triggers multiple symptoms.

Common use cases

• Group alert storms
• associate related service failures
• route incident investigations.

Benefits

• Reduces repetitive notifications and collects evidence in one place.

Limitations

• Broad grouping can hide independent failures. Similar alert text does not establish a common cause, and grouping features may require a paid plan.

Practical pattern

Choose grouping criteria such as service, dependency, or stable fingerprints. Review merged incidents and tune the time window.

Supported by

Documented examples, not an exhaustive compatibility list. Features require suitable instrumentation and configuration; availability can depend on the runtime, backend, and subscription.

• PagerDuty — Intelligent Alert Grouping associates related incoming alerts with incidents when configured.

Related concepts

• Event Correlation
• Root Cause Analysis
• Metric Correlation

Investigation patterns

• Alerts to Incidents

Related guides

• What is Observability?
• What is MTTR?

FAQ

Does deduplication equal correlation?

Deduplication collapses repeated copies of one alert. Correlation associates distinct alerts that may describe a shared incident.