use case: sandbox incident status

[00041275]

Help me solve the problem via keep. I have alerts coming from 500 servers using Zabbix. The truth is that I don't care until 50% of them go down. I don't need to create an incident until alerts appear on 250 servers. In general, what is the best way to proceed in a case when you have alerts, if some kind of sandbox for waiting for the threshold of sufficiency for an alert to be recalculated? Maybe some kind of sandbox status will appear in the incident by correlation that does not require action?

[shahargl]

Mmm that’s interesting use case.

We have the concept of “incident candidate” which is the case where you “maybe” eventually have an incident but maybe not.

maybe we can extend it to the threshold use case

[00041275]

ncident candidate

Where is it status?

[00041275]

How to use "Incident-candidate", where I need it fire? in doc, I can't understand how to use it in practice.

[shahargl]

its not a "status" but kinda boolean (incident candidate is either true/false). its a whole different table. I think it will be better to demo it or smth.