"...we're not in Kansas anymore.
-The Wizard of Oz

Once you have a monitoring policy in place, Superwise will scan and search for potential violations across the different segments that were defined to scan. Once detected, an incident will be created.
To reduce noise, and provide the user with the full context of an issue, incidents aggregate all relevant policy violations that took place in the same timeframe on the same segment. As long as the policy has open violation based on its conditions, the incident will remain open.