When you create an "Orion Alert Source" the Alert Central subscribes to alert related changes in Orion - Orion sends an indication to the Alert Central when any alert in the Orion is triggered/updated/reset. This is handled by Alert Central depending on whether there is already an alert and based on "Route to Group" rules.
When there is already a non-closed alert in Alert Central for the same Orion alert (the same alert; same object), the change is simply logged to that existing alert as a note.
When no such alert exists and an alert is triggered in Orion, the "Route to Group" rules are evaluated:
- when the result is that the alert is assigned to a group a new alert is created in Alert Central and the workflow/escalation policy starts
- otherwise the Orion alert is ignored ("trashed") - no alert is created in Alert Central
- note that no alert is created for Orion alerts which are already triggered when the integration is configured; only the triggered action can create an alert in Alert Central