> ## Documentation Index > Fetch the complete documentation index at: https://docs.anomalyarmor.ai/llms.txt > Use this file to discover all available pages before exploring further. # Incident Correlation > Group cascading alerts into a single incident with a root cause and blast radius When an upstream table breaks, the problem rarely stays put. A stale source feeds a cleaned table, which feeds a metric, which feeds a dashboard, and every monitored asset along the way fires its own alert. One root cause becomes a wall of notifications. Incident correlation collapses that wall. Instead of one incident per affected table, AnomalyArmor uses your lineage graph to group the cascade into a **single incident** with a named **root cause** and a visible **blast radius**. A stale upstream source cascades through lineage, firing an alert on each downstream asset; correlation groups them into one incident with a root cause and blast radius A stale upstream source cascades through lineage, firing an alert on each downstream asset; correlation groups them into one incident with a root cause and blast radius ## How correlation works When an alert fires for an asset that participates in your lineage graph, AnomalyArmor walks **upstream** to find the most-upstream asset that is also currently failing. That asset is the **root cause**, and its incident becomes the single home for the whole cascade. * **Root cause**: the most-upstream failing asset. When several upstream assets are failing at once, the one furthest upstream wins; ties break toward the failure that started first and then the one with the largest downstream impact. * **Blast radius**: every downstream asset whose alert is grouped under the root incident, each labeled with its **hop distance** (how many lineage steps it sits from the root cause). * **One notification**: the root incident sends a single Slack message. Later alerts from the same cascade post as **threaded replies** under it rather than new top-level messages, so a channel shows one thread per incident. Assets without lineage are unaffected: an alert on an asset that has no lineage node creates a standalone incident, exactly as before. Correlation builds on the lineage you already have in AnomalyArmor. The more complete your lineage graph, the more accurately cascades are grouped and attributed. See [Lineage](/guides/lineage-upload) to enrich it. ## Viewing a correlated incident Open any incident from the **Incidents** view. A correlated incident shows: * the **root cause** asset at the top, * the **blast radius**, the list of downstream assets pulled into the incident, ordered nearest-to-farthest from the root cause, * the underlying alerts, each still individually visible and resolvable. The blast radius is the real set of assets that actually alerted, not a generic lineage fetch, so it reflects exactly what this incident is affecting right now. ## Auto-resolution A correlated incident resolves itself once **every** alert grouped under it has been cleared (resolved or dismissed). A system entry is added to the incident timeline when this happens. If the cascade re-fires later, a new incident is created through the normal flow. Incidents you have **snoozed** are never auto-resolved while the snooze is in effect. An intentional pause is always respected. ## Availability Incident correlation is on by default for accounts with lineage. It is fully backwards compatible: incidents you already have keep behaving exactly as before, and nothing about alert detection or thresholds changes. To adjust correlation behavior for your account, contact support. ## Related How events become notifications across your destinations. Tune alerts to cut noise and avoid alert fatigue.