The below alarm definition triggered a notification policy because it got linked to a Service that it has nothing to do with.
Source = OI | Alarms | Metrics | All
Metric = all_alarms | tenant | <your Teant ID> : new_alarm_count
The alert lifecycle is here:
For some reason, the "external_ids" show it linked to particular agents, rather than the OI alarm metric.
The problem is related to defect # DE634999 : incorrect association of external_ids to the alarm metrics like new_alarm_count, minor_alarm_count, time_to_close, these are the tenant level metrics which should not have any external_id associated with.
For SaaS users:
the fix will be available in next SaaS release.
For On-premise 24:
the fix will be available in the next on-premise 25.x release