Severity Mapping¶

Severity mapping is used to convert event severities into incident severities, and can be reused by the "aggregate events by time window" method of aggregation rules, as well as the "select existing mapping rule" method when associating incidents with monitors.

You can create and manage severity mappings under Incident > Configuration Management > Severity Mapping.

Create a Severity Mapping¶

1. Click Create;
2. Enter a mapping name;
3. Select a target incident severity for one or more event severities;
4. Save.

The mapping name must be unique within the current workspace. Each event severity can only be assigned one target incident severity, and at least one mapping relationship must be configured.

After saving, the severity mapping is immediately available for selection in aggregation rules and monitor-incident associations, without requiring additional activation.

Manage Severity Mappings¶

The list displays the mapping name, severity relationships, and options. The following operations are supported:

• Edit: Modify the mapping name or severity relationships. Changes only affect subsequent events and subsequent time windows; they do not modify already generated incidents or historically associated events;
• Duplicate: Creates an independent copy of the mapping. Please modify the name to one that is not already in use before saving;
• Delete: Mappings that are not referenced can be deleted.

Usage Notes¶

• When aggregating events by time window, a severity mapping must be selected; events that do not match any mapping relationship will not participate in aggregation;
• When associating incidents with monitors, you can choose either a custom mapping or an existing severity mapping. Switching back to a custom mapping will retain the custom mapping content saved before the switch;
• The enabled/disabled status of severity mappings is independent of that of aggregation rules. Severity mappings do not have an enabled or disabled state.