Cluster by Shared List Items (Match Lists)


What Is It?

It's a technique used to cluster alerts on the intersection of a list attribute.

When To Use It

For example, you would like to create Situations clustered around the same impacted business services because they relate directly to your teams' organization. The common factor in a Situation is business services. However, a server can impact multiple business services so you need to cluster on the intersection of these. Since an alert is attached to multiple services, it can appear in multiple Situations. But this is still acceptable behavior for you and it is easy to see which other Situations an alert is part of, and perhaps worth consulting the knowledge base of the parallel Situation as well.

The type of attribute used in list matching must be an array.

Additional Resources