Critical violation but we had not any notifications

We have this policy
and yesterday we had 2 critical violations

the violations didn’t open an incident so we didn’t received the notifications thru our channels


Hello @luca.formicola, It appears that the alert policy is set with Incident Preference type of By Policy. This means that the first time a condition is violated under a policy an incident is opened and you will get notified. If any subsequent conditions or entities violate under the same policy they will be rolled up under the same incident but you will not get any additional notifications for these new violations. Incident 17541246 was opened in this case and all subsequent violations were rolled up in the same incident. In order to receive new notifications with the By Policy incident preference type, all violations under that incident must be closed.
In order to receive notifications for every entity violation in your policy, I would suggest using the By condition and entity incident preference type for your policy.

For more information on incident preference type please refer: