Section 12 - Situation Enrichment Add data from external sources to add contextual information to Situations

Topics In This Section Situation Enrichment Processes Services Teams

Enriching Situation Data Add contextual data to Situations Example: AIOps calls attention to a high severity “Unable to open database file” Situation Cross referencing a CMDB can tell us what service / application this supports, where it is located, etc Static enrichment - look up static data (i.e. country code) Dynamics enrichment - (i.e. hostname in an elastic computing environment) AIOps can utilize an external CMDB source to present contextual data that helps operators’ understanding of a Situation. For example, without cross referencing your CMDB, you may not know how the struggling database is affecting the customer’s activity. When you know what service (i.e. “inventory”, “login”) is affected, which region the trouble is originating, which application the service is supporting, your troubleshooting activities will be more focused and will take less time to assess the impact.

Types of Situation Enrichment Built-In SituationMgrLabeller.js - (yes the file has two ‘L’s in it) Easy To Use Do Not Need to write any code You already used it in a Lab Custom Modifications you make to Situation Manager Moobot Not Hard – but requires you to create the JavaScript code Uses much of the same API calls you have been using

Using Situation Manager Labeler Moobot What Is It? The ability to dynamically substitute Alert properties in the Situation Description How Does It Work? Specify the Alert property in the Situation description with a preceding $ Aggregates the property for all the Alerts in the Situation Beware – If Alert Enrichment is not done optimally you could see odd behavior

Labeler Command Format $[command](field[,limit]) The optional 'command' is an uppercase word: COUNT (count all non null elements in this aggregate) UCOUNT (count all unique elements in the aggregate) MIN (Smallest element in the aggregate) MAX (Largest element in the aggregate) AVE (Average of the elements in the aggregate) UNIQUE (Deduplicate the aggregates) (not providing a command will yield the full array of non null aggregates) The field is the field in the alerts table including custom_info, use dot notation for deep levels on custom_info. The optional 'limit' is the size limit of the displayed aggregate and the system will output the limit number of elements followed by an ellipsis (..) if the aggregate is truncated.

Lab Source - $UNIQUE(source) Labeler Example #1 Lab Source - $UNIQUE(source)

Labeler Example #2 Example encode for a recipe description: My Description - Agg states$(state,3) count ($COUNT(state)) $UNIQUE(state) sum $SUM(custom_info.int) max $MAX(custom_info.int) Values $UNIQUE(custom_info.foo.bar) Produces something like: My Description - Agg states[2,2,2,..] count (4) [2] sum 127 max 35 Values ["My Foo Bar"]

Situation Enrichment Operational - Use external data to modify the behavior within AIOps Ownership / geographic info to influence assignment Diagnostic - Use external data for investigation Add the results of a runbook automation to a situation discussion thread) Informational - Use external data to inform operators or external systems (consumers) ServiceNow ticketing & bidirectional updates By brining in external data, you are typically trying to achieve these results. Consider the type of data required for each step as the data flows through AIOps, as that would determine the timing and methodologies for enrichment. Ownership Info - You may want to provide a breakdown view for a group of entities by departments or division within your company based on ownership information stored in a CMDB source. Geographic placement - Whilst some managed entities may span multiple geographic locations such as WAN components you may want to build situations clustered by geographic locations. You may also want to present breakdown views at this level or perhaps your operation teams are broken down by geography such as separate NOC’s for NA, EMEA, AP.

When In Alert and Situation Processing To Enrich? In General Enrich as late as you can and still have the enrichment be helpful Minimize the queries to the enrichment source by enriching as late as possible Alert Builder Operational Enrichment Alert Rules Engine Alert Clustering Situation Management Informational Enrichment

Opportunities For Enrichment Situation Description From Alert properties From Sigaliser Creating the Situation Set Process and Service From CMDB Uses Properties and/or customInfo from Alert