How Correlated Alerts gets Ticketed

Alerts consists of the following types of clusters:

Acknowledgment Cluster
Ticketed Cluster

Acknowledgement Cluster - Ticketing Process

Manual Ticket Creation

Alerts from an acknowledgement cluster, can be manually ticketed, if required. To know more about ticketing an acknowledgement cluster, see Ticket Creation - Manual

Auto ticketing for Acknowledgement alerts based on ticket threshold

An acknowledgement alert do not get auto-ticketed since they just need to be acknowledged. However, in certain scenarios, administrator can set up a ticket threshold
for acknowledgement alert . If the acknowledgement alerts in a cluster breaches the threshold, a ticket will be automatically created with the breach alerts.

Ticketed Cluster - Ticketing Process

Auto ticketing for Ticketed Alerts

An alert that does not satisfy acknowledgement policy or needs to be ticketed correlates into a ticketed cluster. The ticketed cluster will be automatically ticketed.

Manual Ticket Creation for Ticketed Alerts

User have the provision to manually split a particular alert from a ticketed cluster to create a new ticket. To know more about manual ticket creation for tticketed alerts, see Ticket Creation - Manual