Abstract: An example implementation may involve: obtaining a representation of an alert; identifying a host within a network that is associated with the alert; selecting, from a plurality of service maps defining services that are operable within the network, a service map including the host; identifying process-to-process connections between the host and each of one or more other hosts; and generating, based on the process-to-process connections, a group alert indicator characterizing respective relationships between the alert and alerts associated with the one or more other hosts.

Abstract: A method includes obtaining a plurality of alerts. Each alert is associated with a respective cause for the alert. The method includes assigning each alert to a respective bucket of a plurality of buckets based on separation criteria. The method also includes distributing the alerts across a plurality of grouping jobs based on the assigned respective bucket. Each grouping job is associated with one or more buckets of the plurality of buckets. For each grouping job, the method includes grouping the alerts within each bucket based on the respective cause for each alert. After each grouping job groups the alerts within each bucket, the method includes generating, for each group of alerts, a single notification.