Auto-Close policies allow you to change how APEX AIOps Incident Management automatically closes alerts and incidents. For an overview of the Auto-Close feature, see Auto-Close Policies overview.
To access Auto-Close policies:
Navigate to Correlate & Automate > Auto-Close Policies.
Click the Alert Policies tab to access settings for alerts, or the Incident Policies tab to access settings for incidents.
The configured policies of the selected type appear on the tabs.
These filters identify alerts or incidents that should never close via automation.
To add Never Auto-Close filters:
Click Edit.
If the feature is disabled, toggle the switch to Enable Never Auto-Close.
Click inside the scope filter box and build a filter that identifies the alerts or incidents (depending on the selected tab).
For guidance on using the scope filter, refer to Build a scope filter query.
Click Scope Preview to check that the expected alerts or incidents are included in the scope.
Click Apply to use the scope as a filter.
Click Add Never Auto-Close Filter to add additional filters.
Click Save.
Note
When you enable Never Auto-Close, you must configure at least one filter.
The process is very similar for adding alert and incident policies. The common steps are included below, and any differences are noted in the steps where they occur.
To add a new policy:
On either the Alerts or Incidents tab, click Add Auto-Close Policy.
A new policy opens.
Enter a name (required) and a description (optional) for the new policy in the fields provided.
Click inside the scope filter box to define the alerts or incidents to include, using field and data values.
For guidance on using the scope filter, refer to Build a scope filter query.
Click Scope Preview to check that the expected incidents or alerts are included in the scope.
Click Apply to use the scope in the preview with your policy.
Choose when automation closes matching items.
Do one of the following:
For alert policies:Close resolved alerts that have not been updated for <time>
Closes alerts with a status of Resolved that have had no updates for the specified length of time.
Close any alerts that are older than <time>
Closes all alerts older than the specified age.
OR
For incident policies:Close resolved incidents that have not been updated for <time>
Closes incidents with a status of Resolved that have had no updates for the specified length of time.
Close any incidents that are older than <time>
Closes all incidents older than the specified age.
Click Save at the top of the page.
Select how to handle the alerts when an Auto-Close policy closes the incident where they are included. Note that the setting you select is global and not specific to a single policy.
You can choose either:
Close the incident and all alerts which are not part of any other incident
Included alerts close when an incident automatically closes, but only when they are not included in any other incident. This option prevents accidentally closing alerts in other incidents, which can affect the statuses of those incidents.
Close the incident and all alerts it contains, including those that are part of other incidents
When an incident closes automatically, the included alerts also close, regardless of whether they are part of other incidents or not.
NOTE: Selecting this option closes alerts even if they are included in other incidents. Use this setting with caution.
To ensure that all alerts eventually close, it is a best practice to include an alert policy with no filter in your list of policies. Select a duration that is longer than any duration defined in another policy, otherwise this policy may close more alerts than intended.
You can verify that the correct policy is closing alerts by viewing closed alerts on the Alerts page.