Can we auto assign alert to SOI user who ACK'd the alert?

[Daniel Blanco]

Currently using the Spectrum and Nimsoft connectors.

Our NOC is looking to know if is it possible to enhance the SOI functionality to auto assign the alert to the SOI user who ACK'd the alert?

[Daniel Blanco]

BUMP, anyone know if this is possible?

[Jose Vicente Espinosa]

Hi,

 

you could do the following:

 

1) Define a AlertQueue for alerts with acknowledge

2) Assign an Escalation policy to this alert queue that trigger a action inmediately

3) The action must run an script that:

     3.1) Looks in SAMStore and gets the name of the user who did the acknowledge action

     3.2) Update the Assigned attribute of the alert via REST Web Service

 

Please, let me know if you need how to perform.

Regards

[Daniel Blanco]

Yes please can you explain how you would do this? Is there a way to do this without adding another alert queue? We have minimal alert queues to keep things clean and specific.

I would need help with the script part and the update portion of the alert via REST Web service calls..

[Jose Vicente Espinosa]

The only way I know to trigger an action when alert status changes is using alert queues. You could create a queue but not present to normal users.

I will back to you with Rest example

Regards

[Daniel Blanco]

Hi Espjo04, any reply back yet regarding this? I don't fully understand the rest portion. Is it basically mimicking the UC functionality but making calls to the WebService that does that same thing? To utilize the REST do you have to program java or powershell then have the 3rd party application call that program when events occur?

[Andre Wawrzyniak]

Hi,

 

dunno if you already solve this. With SOI 3.3. you are able to create an action which acknowledges the alert and updates the assigned attribute with the user id . In that case you dont need any scripts.

 

regards

 

Andre

[Daniel Blanco]

Hi Andre, I actually tried this out on SOIv3.3 with the Policy that says when Acknowledge = YES, then Action: Update_Alert and I tried the AssignedTo = $[SOI_USER]@$[SOI_HOST] but that does not work. All alerts that have their ACK property set to YES then get the value:  NotSet@NotSet

 

Did you have any luck with this Action: Alert_Update?

[Jose Vicente Espinosa]

Have you tried to use $[Login User] and $[Login Host] as RuntimeTokens?

 

Regards

[Daniel Blanco]

Actually those are the variables I tried. But it doesn't work. Also there is no way as far as I can tell to specify If Ack changes from No to YES then do this action. Which is better applicable since if the alerts already contain ACK = YES, this will change the existing person assigned to it with NOT_SET@NOT_SET. 

[Anon Anon]

Could you please provide additional details on how to Update the Assigned attribute of the alert via REST Web Service.

 

The user who has acknowledged the alert could be fetched from the table AuditRecords.

[Michael Boehm]

Rather than using escalation policies and external scripts, you can do the following:

• Define an Escalation Action to "Acknowledge and Assign" an Alert
  • This consists of the action "Update Alert" with
    • Acknowledged = Yes
    • Assigned = $[Login User]
• Then ask your people to use this Action on the console rather than the normal Acknowledge

 

The $[Login User] is only set when interactively working on the console, e.g. it only works for manually executing an Action.

If you use this variable in an Escalation Policy you get "not Set", because an Escalation Policy is triggered by the SA Manager and not by a user.

 

MichaelBoehm

[Anon Anon]

Thanks a lot for the alternative. The suggestion is good but we already have multiple actions defined in our environment due to which it might become tedious for the team to select the 'Acknowledge' action in comparison to selecting the "Acknowledge/Unacknowledged" icons.

 

- Is there a way to create this action and somehow attach it with the "Acknowledge" icon in the SOI Alerts console i.e whenever the user click on the acknowledge icon, this new action is being executed. OR

- Get a new icon added to the SOI Alerts console and link this new Action 'Acknowledge' with this new icon.

 

Also by acknowledging an alert using an action doesn't get recorded in the 'Recent Audit Trail' nor in the 'Update History'. Is there any alternative to track these activities.

[Daniel Blanco]

Thanks Michael, thanks for the reply but like Sachin mentioned as well, in the NOC, Ack'ing the alert thru the r-click, take action, then selecting that specific Action in the list of other actions of a list of 30+ actions is too tedious. Would really want a way link this action when someone does the Acknowledge action from the SOI Console.

 

"If you use this variable in an Escalation Policy you get "not Set", because an Escalation Policy is triggered by the SA Manager and not by a user."

Would like there to be an option in the SOI Escalation Actions to have this option so we can accomplish this the way we need it to work. In a NOC environment, the person who Ack's the alert is usually the person who is responsible/assigned until he/she then opens a Ticket and the ticket is then sync'd with the alert and the Assigned is then set to who's assigned to the ticket in the ticketing system.