DevOps Agent Webhook duplicate incidentId is linked, not discarded
1 min read
The DevOps Agent Webhook docs say "Duplicate messages are deduplicated," so I expected the second submission with the same incidentId to be silently dropped.
What actually happened: both requests created separate Investigations, which were then linked to an existing related Investigation. The linked Investigation transitioned back to In Progress and completed in 42 seconds. It's "link and reprocess," not "discard."
EventBridge fires an Investigation Linked event (status: LINKED). It's listed as the 9th Investigation event type in the documentation, but its trigger conditions aren't described.
When building alarm-to-Webhook pipelines, decide upfront whether to include a timestamp in incidentId for uniqueness or accept the linking behavior.
