Investigate events and operational alerts

Review a new event

Open Event operations workspace from the finder. Confirm source, event time, affected resource, severity, and normalized CI. Check whether the event is grouped or deduplicated with another signal. Review the linked alert or work record before starting duplicate investigation.

Diagnose a source or automation

1. Check provider connection, the last successful ingest and the failed stage. Compare a known event with the normalization result.
2. Verify CI identity and correlation conditions. For noisy or duplicate signals, compare deduplication keys and grouping windows before editing policy.
3. Inspect the linked incident or automation receipt. If retry is available, confirm the previous attempt's delivery state and use the same correlation evidence.
4. Verify the latest status and record the event time, source, CI, and downstream IDs.

See Notifications and event delivery for provider failure and replay checks.