Just adding some notes to help out here. The alerting is implemented this way:
- when anything comes from Orion (trigger, update, reset of an alert), then AC tries to find the active alert for the Orion alert/entity combination
o active alert means that it is not closed
o => when the user closes the alert and the alert is re-triggered in Orion, then a new alert is created in AC
- Only trigger event in Orion creates a new alert in AC; other actions (update, reset) are ignored when there is no matching alert in AC
o => when the alert in AC is not yet closed (is active), then any update from Orion side is added only as a note to AC alert
- “alert was re-activated” note means that the alert in Orion is triggered again (it was reset since the AC alert was created)
- “alert is no longer active” note means that the alert in Orion is no longer triggered
o state of the alert in AC is not changed when the alert is changed on Orion side, only a note is added
- there is no action based on events from Orion alerts causing AC alert state change (except the triggered action, which creates new alert)
- also there is no timing related to Orion alerts in the code; the timing is escalation policy based