Suggest a tweak to the incident management rule logic to allow multiple steps for one action, for example: send a webhook and then suppress an alert so the incident goes away but has been despatched to another system before disappearing from Netreo. (Doing the things in the specificed order would be important)
Enables that system to have alerts for things the primary desk aren't interested in without clogging netreo up with stale alerts that need dealing with.
Rough mock-up attached to show what I mean.
Netreo Product Area | Netreo (IM) |