We’ve created a script to alert our staff via SMS when we have a violation that’s been open for more than 15 minutes. We do this by making the following NRQL query:
SELECT timestamp, accountViolationId, label.Name, conditionName, violationUpdateType FROM InfrastructureEvent where violationUpdateType is not null SINCE 7 days AGO limit 1000
We then look at each accountViolationId to see if there are any existing violationUpdateType = ‘opened’ without a corresponding ‘closed’. This is working well.
I’d like to suppress this SMS notifiction once an open violation has had its incident acknowledged but the InfrastructureEvent table does not seem to have any information regarding the state of any alerts issued against violations. Is there another table I can join to get this info? If not, how would you suggest I detect when an alert for an open violation has been acknowledged?