Alerts APIs control everything that happens to an alert between ingestion and incident creation: tagging, enrichment, filtering, correlation, and planned suppression.It's generally best practice to work through this category in pipeline order as each stage depends on the one before it:
1.
Alert Ingestion: Get alerts into BigPanda and resolve them in bulk.
2.
Alert Tags & Enrichment: Define the tags that carry structured context (host, service, severity) and the rules that populate them. Correlation and filtering both key off these tags. See Alert enrichment.
3.
Mapping Enrichment: Lookup-table enrichment — translate one tag value into another from CSV or JSON data, for example mapping hostnames to service owners from your CMDB.
4.
Correlation Patterns: The rules that cluster related alerts into incidents. See Alert correlation logic.
5.
Topology: Topology models that make correlation infrastructure-aware.
6.
Alert Filters and Maintenance Plans: Suppress known noise and planned-work alerts before they reach operators.
If alerts are flowing but incidents look wrong, the cause is almost always upstream: check enrichment before correlation, and correlation before filters.
