1. Section 12 - Situation Enrichment
Add data from external sources to add contextual information to Situations

2. Topics In This Section
Situation Enrichment
Processes
Services
Teams

3. Enriching Situation Data
Add contextual data to Situations Example:
AIOps calls attention to a high severity “Unable to open database file” Situation
Cross referencing a CMDB can tell us what service / application this supports, where it is located, etc
Static enrichment - look up static data (i.e. country code)
Dynamics enrichment - (i.e. hostname in an elastic computing environment)
AIOps can utilize an external CMDB source to present contextual data that helps operators’ understanding of a Situation.
For example, without cross referencing your CMDB, you may not know how the struggling database is affecting the customer’s activity. When you know what service (i.e. “inventory”, “login”) is affected, which region the trouble is originating, which application the service is supporting, your troubleshooting activities will be more focused and will take less time to assess the impact.

4. Types of Situation Enrichment
Built-In
SituationMgrLabeller.js - (yes the file has two ‘L’s in it)
Easy To Use
Do Not Need to write any code
You already used it in a Lab
Custom
Modifications you make to Situation Manager Moobot
Not Hard – but requires you to create the JavaScript code
Uses much of the same API calls you have been using

5. Using Situation Manager Labeler Moobot
What Is It?
The ability to dynamically substitute Alert properties in the Situation Description
How Does It Work?
Specify the Alert property in the Situation description with a preceding $
Aggregates the property for all the Alerts in the Situation
Beware – If Alert Enrichment is not done optimally you could see odd behavior

6. Labeler Command Format
$[command](field[,limit])
The optional 'command' is an uppercase word:
COUNT (count all non null elements in this aggregate)
UCOUNT (count all unique elements in the aggregate)
MIN (Smallest element in the aggregate)
MAX (Largest element in the aggregate)
AVE (Average of the elements in the aggregate)
UNIQUE (Deduplicate the aggregates)
(not providing a command will yield the full array of non null aggregates)
The field is the field in the alerts table including custom_info, use dot notation for deep levels on custom_info.
The optional 'limit' is the size limit of the displayed aggregate and the system will output the limit number of elements followed by an ellipsis (..) if the aggregate is truncated.

7. Lab Source - $UNIQUE(source)
Labeler Example #1
Lab Source - $UNIQUE(source)

8. Labeler Example #2
Example encode for a recipe description: My Description - Agg states$(state,3) count ($COUNT(state)) $UNIQUE(state) sum $SUM(custom_info.int) max $MAX(custom_info.int) Values $UNIQUE(custom_info.foo.bar) Produces something like: My Description - Agg states[2,2,2,..] count (4) [2] sum 127 max 35 Values ["My Foo Bar"]

9. Situation Enrichment
Operational - Use external data to modify the behavior within AIOps
Ownership / geographic info to influence assignment
Diagnostic - Use external data for investigation
Add the results of a runbook automation to a situation discussion thread)
Informational - Use external data to inform operators or external systems (consumers)
ServiceNow ticketing & bidirectional updates
By brining in external data, you are typically trying to achieve these results. Consider the type of data required for each step as the data flows through AIOps, as that would determine the timing and methodologies for enrichment.
Ownership Info - You may want to provide a breakdown view for a group of entities by departments or division within your company based on ownership information stored in a CMDB source.
Geographic placement - Whilst some managed entities may span multiple geographic locations such as WAN components you may want to build situations clustered by geographic locations. You may also want to present breakdown views at this level or perhaps your operation teams are broken down by geography such as separate NOC’s for NA, EMEA, AP.

10. When In Alert and Situation Processing To Enrich?
In General
Enrich as late as you can and still have the enrichment be helpful
Minimize the queries to the enrichment source by enriching as late as possible
Alert Builder
Operational
Enrichment
Alert Rules Engine
Alert Clustering
Situation Management
Informational
Enrichment

11. Opportunities For Enrichment
Situation Description
From Alert properties
From Sigaliser Creating the Situation
Set Process and Service From CMDB
Uses Properties and/or customInfo from Alert