Adding a custom use case to enable Orchestration actions

This topic walks you through the process of adding a custom use case for enabling custom Orchestration actions on TrueSight Presentation Server. 

Overview

The Event Orchestration runbook supports Orchestration actions for events generated in the TrueSight Orchestration Management application.

For example, if a service down event appears in the TrueSight Console (from Monitoring > Events page), a TrueSight operator can select Launch Orchestration Actions > Start Service for the event. TrueSight Orchestration then performs a set of actions that starts with verifying whether the service is stopped on the target server (perform triage action), create or update an incident (post-triage action), create a change request in BMC Remedy IT Service Management (pre-remediation action). After the change is approved, start the service, (perform remediation), invoke post-remediation to perform validation, close change request and update the incident.

For more information about the out-of-the-box use cases, see  Using Orchestration actions to enable triage and remediation of events. Open link  

Using the runbook framework, you can add Orchestration actions for more PATROL or Alarm type of events. 

The following graphic shows an end-to-end process to add a custom use case to enable Orchestration actions. 

Step 1: Preparing to add a custom use case

Requirements for TrueSight Presentation Server
  • Add a TrueSight Orchestration as a component to integrate with Presentation Server.
  • Ensure that the user that you provide to integrate with TrueSight Operations Management is a part of the AoAdmin group in Remedy Single Sign-On.
  • Ensure that you have the permission to view and initiate Orchestration actions from events. This permission is governed by the Allow Orchestrator Actions permission on the Roles page.
  • (Optional) If you plan to use BMC Service Resolution, ensure that Presentation Server 11.3.02 is integrated with BSR.
  • (Optional) If you plan to use Proactive Service Resolution, ensure that Presentation Server 11.3.03 is integrated with PSR.

For more information, see Using Orchestration actions to enable triage and remediation of events Open link


Requirements for TrueSight Orchestration
  • Ensure that Event Orchestration runbook is installed and configured on the compatible TrueSight Orchestration Platform. For instructions, see Installing the Event Orchestration runbook Open link .

Step 2: Creating a new module and workflows

You can only create new modules and workflows in the Development Studio. After all changes are complete, from the Development Studio, you export the modules to the CDP and activate them for the changes to take effect.

Important

When you export a module from the Development Studio to the repository and activate it on the Grid Manager, previous module configuration values are overwritten.

If you make changes to the module configuration directly on the Grid Manager, ensure that when you import the modules in the Development Studio from the repository, the changes made on the Grid are updated in the modules before you export the modules from the Development Studio to the repository.

  1. On the TrueSight Orchestration Development Studio Launch Pad, click Designer.
  2. In the Project Navigator tree, right-click the name of the grid and select Create New Module.
  3. In the New Module dialog box, select Projects from the Module Type list.
  4. In the Name field, specify a name for your module.

    Note

    Do not use any special characters while specifying the module name.

  5. Click OK.
    Your new module is created and it contains the following elements:
    1. Configuration
    2. Schedule
    3. Rules
  6. After the module is created successfully, go to the Configuration and create configuration items for your use case. For example, for the service down use case, you provide the list of services and the commands to start the service in the Aliases configuration item. 

You have successfully created a module. In the next step, you create workflows in this new module.

Step 2.1. To develop a triage workflow

You need to create workflows depending on the actions that you want TrueSight Orchestration to execute. For example, if you want to only verify whether the event is valid and the problem exists on a target server, you can only develop the Perform Triage workflow in the module. If you want TrueSight Orchestration to resolve the problem, you need to develop Perform Remediation and Perform Validation workflows in the module.

  1. On the TrueSight Orchestration Development Studio Launch Pad, click Designer.
  2. In the Project Navigator tree, right-click the module name and select New Process.
  3. In the Create New Process dialog, specify Perform Triage in the Process Name field and click OK.

    Important

    Workflow name must be Perform Triage. Do not provide any other workflow name.

  4. For the Perform Triage workflow, ensure that you use the following input parameters.

    Input parameterTypeDescriptionRequired
    event dataXML

    Contains the event data received from the TrueSight Presentation Server in a common event model format.

    Sample event data
    Yes
    target connection dataXML

    Contains the connection details (in XML) obtained from the Credentials Store Management module.

    <connection-details>
      <component xmlns:xalan="http://xml.apache.org/xalan" type="unix" name="HOST NAME AS CAPTURED IN THE EVENT AND/OR IN THE CREDENTIALS STORE">
        <username>userID</username>
        <password-configuration-name>UnixCredentials</password-configuration-name>
        <invocation-mechanism>ssh</invocation-mechanism>
        <ping-mechanism>command-line</ping-mechanism>
        <adapter-options />
        <command-options />
        <adapter-name>SSHAdapter</adapter-name>
        <ping-adapter-name>Command Line</ping-adapter-name>
      </component>
      <password>
        <EncryptedData xmlns="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Content">
          <CipherData>
            <CipherValue>EypYPlQ/ST66jSgT8mqE5Q==</CipherValue>
          </CipherData>
        </EncryptedData>
      </password>
    </connection-details>

    The <target-connection-data> should contain the following elements:

    <component>: Specifies the host name as defined in the credentials store management module. Supports Windows or UNIX host, or a database type.

    <username>: Specifies the username required to log on to the target host.

    <password>: Specifies the password that matches the username.

    <invocation-mechanism>: Specifies the type of invocation mechanism to be used to communicate with the target host. Supported invocation mechanisms – ssh, telnet, windows-command, command-line, windows-powershell.

    <ping-mechanism>: Specifies the mechanism used to ping the target host.

    <adapter-options>: Specifies the comma-separated values to use additional options in the adapter request, such as use-ssl-certificates, install-certificates and so on. The list of options varies based on the adapter used for invocation mechanism.

    <command-options>: Specifies the comma-separated list of commands to provide additional options to commands, such as ignore-exit-code, prompt, and so on. The list of options varies based on the adapter used for invocation mechanism.

    <adapter-name>: Specifies the adapter name used to perform actions on the target host.

    <ping-adapter-name>: Specifies the name of the adapter to be used to ping the target machine to verify whether it is reachable. Example: Command Line.

    <password>: Specifies the password in an encrypted format, used to authenticate with the target.

    Yes
  5. For the Perform Triage workflow, ensure that you use the following output parameters.

    Output parameterDescriptionRequired
    triage output

    Contains the output for the triage process including the status of the workflow and errors, if occurred.

    Contains the following elements:

    <status>: Specifies the status of the triage workflow. Valid values: Success, Failure.

    <command>: Specifies the command that is invoked. Example, ping

    <command-output>: Contains the output of the command

    <remediation-required>: Specifies whether the triage process requires a remediation action. Valid values: true, false.

    <start-time>: Time (in an epoch format) when the Perform triage workflow starts.

    <end-time>: Time (in an epoch format) when the Perform triage workflow ends.

    If true, the Perform Remediation workflow is launched.

    Yes

Back to top

Step 2.2. To develop a remediation workflow

You develop a Perform Remediation workflow if you want to resolve the problem identified during a triage process. For example, for a Service Down event, TrueSight Orchestration performs triage, where it verifies whether the service is stopped. After the triage is successful, a remediation action to restart the service is launched. However, in case of a Host Down event, only a triage workflow is used to verify to ping the host computer and check whether it is down. 

If your use case requires a remediation action, use these steps to develop a remediation workflow:

  1. On the TrueSight Orchestration Development Studio Launch Pad, click Designer.
  2. In the Project Navigator tree, right-click the module name and select New Process.
  3. In the Create New Process dialog, specify Perform Remediation in the Process Name field and click OK.

    Important

    Workflow name must be Perform Remediation. Do not provide any other workflow name.

  4. For the Perform Remediation workflow, ensure that you use the following input parameters.

    Input parameterDescriptionRequired
    event data

    Contains the event data received from the TrueSight Presentation Server in a common event model format.

    Sample event data
    Yes
    target connection data

    Contains the connection details (in XML) obtained from the Credentials Store Management module.

    <connection-details>
      <component xmlns:xalan="http://xml.apache.org/xalan" type="unix" name="HOST NAME AS CAPTURED IN THE EVENT AND/OR IN THE CREDENTIALS STORE">
        <username>userID</username>
        <password-configuration-name>UnixCredentials</password-configuration-name>
        <invocation-mechanism>ssh</invocation-mechanism>
        <ping-mechanism>command-line</ping-mechanism>
        <adapter-options />
        <command-options />
        <adapter-name>SSHAdapter</adapter-name>
        <ping-adapter-name>Command Line</ping-adapter-name>
      </component>
      <password>
        <EncryptedData xmlns="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Content">
          <CipherData>
            <CipherValue>EypYPlQ/ST66jSgT8mqE5Q==</CipherValue>
          </CipherData>
        </EncryptedData>
      </password>
    </connection-details>

    The <target-connection-data> should contain the following elements:

    <component>: Specifies the hostname as defined in the credentials store management module. Supports Windows or UNIX host, or a database type.

    <username>: Specifies the username required to log on to the target host.

    <password>: Specifies the password that matches the username.

    <invocation-mechanism>: Specifies the type of invocation mechanism to be used to communicate with the target host. Supported invocation mechanisms – ssh, telnet, windows-command, command-line, windows-powershell.

    <ping-mechanism>: Specifies the mechanism used to ping the target host.

    <adapter-options>: Specifies the comma-separated values to use additional options in the adapter request, such as use-ssl-certificates, install-certificates and so on. The list of options varies based on the adapter used for invocation mechanism. For example, if you use an SSH adapter, see supported actions for the SSH adapter.

    <command-options>: Specifies the comma-separated list of commands to provide additional options to commands, such as ignore-exit-code, prompt, and so on. The list of options varies based on the adapter used for invocation mechanism.

    <adapter-name>: Specifies the adapter name used to perform actions on the target host.

    <ping-adapter-name>: Specifies the name of the adapter to be used to ping the target machine to verify whether it is reachable. Example: Command Line.

    <password>: Specifies the password in an encrypted format, used to authenticate with the target.

    Yes
  5. For the Perform Remediation workflow, ensure that you use the following output parameters.

    Output parameterDescriptionRequired
    remediation output

    Contains the output for the Perform Remediation workflow including the status of the workflow and errors, if occurred.

    Contains the following elements:

    <status>: Specifies the status of the remediation workflow. Valid values: Success, Failure.

    <command>: Specifies the command that is invoked. Example, sc start XYZ_Service

    <command-output>: Contains the output of the command.

    <start-time>: Time (in an epoch format) when the Perform Remediation workflow starts.

    <end-time>: Time (in an epoch format) when the Perform Remediation workflow ends.

    Yes

Back to top

Step 2.3 To develop a validation workflow

You develop a Perform Validation workflow if you want to verify whether the remediation action was complete on the target server. 

If your use case requires a validation action, use these steps to add a remediation workflow:

  1. On the TrueSight Orchestration Development Studio Launch Pad, click Designer.
  2. In the Project Navigator tree, right-click the module name and select New Process.
  3. In the Create New Process dialog, specify Perform Validation in the Process Name field and click OK.

    Important

    Workflow name must be Perform Validation. Do not provide any other workflow name.

  4. For the Perform Validation workflow, ensure that you use the following input parameters.

    Input parameterDescriptionRequired
    event data

    Contains the event data received from the TrueSight Presentation Server in a common event model format.

    Yes
    target connection data

    Contains the connection details (in XML) obtained from the Credentials Store Management module.

    <connection-details>
      <component xmlns:xalan="http://xml.apache.org/xalan" type="unix" name="HOST NAME AS CAPTURED IN THE EVENT AND/OR IN THE CREDENTIALS STORE">
        <username>userID</username>
        <password-configuration-name>UnixCredentials</password-configuration-name>
        <invocation-mechanism>ssh</invocation-mechanism>
        <ping-mechanism>command-line</ping-mechanism>
        <adapter-options />
        <command-options />
        <adapter-name>SSHAdapter</adapter-name>
        <ping-adapter-name>Command Line</ping-adapter-name>
      </component>
      <password>
        <EncryptedData xmlns="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Content">
          <CipherData>
            <CipherValue>EypYPlQ/ST66jSgT8mqE5Q==</CipherValue>
          </CipherData>
        </EncryptedData>
      </password>
    </connection-details>

    The <target-connection-data> should contain the following elements:

    <component>: Specifies the host name as defined in the credentials store management module. Supports Windows or UNIX host, or a database type.

    <username>: Specifies the username required to log on to the target host.

    <password>: Specifies the password that matches the username.

    <invocation-mechanism>: Specifies the type of invocation mechanism to be used to communicate with the target host. Supported invocation mechanisms – ssh, telnet, windows-command, command-line, windows-powershell.

    <ping-mechanism>: Specifies the mechanism used to ping the target host.

    <adapter-options>: Specifies the comma-separated values to use additional options in the adapter request, such as use-ssl-certificates, install-certificates and so on. The list of options varies based on the adapter used for invocation mechanism. For example, if you use an SSH adapter, see supported actions for the SSH adapter.

    <command-options>: Specifies the comma-separated list of commands to provide additional options to commands, such as ignore-exit-code, prompt, and so on. The list of options varies based on the adapter used for invocation mechanism.

    <adapter-name>: Specifies the adapter name used to perform actions on the target host.

    <ping-adapter-name>: Specifies the name of the adapter to be used to ping the target machine to verify whether it is reachable. Example: Command Line.

    <password>: Specifies the password in an encrypted format, used to authenticate with the target.

    Yes
  5. For the Perform Validation workflow, ensure that you use the following output parameters.

    Output parameterDescriptionRequired
    validation output

    Contains the output for the Perform Validation workflow including the status of the workflow and errors, if occured.

    Contains the following elements:

    <status>: Specifies the status of the validation workflow. Valid values: Success, Failure.

    <command>: Specifies the command that is invoked.

    <command-output>: Contains the output of the command

    <start-time>: Time (in an epoch format) when the Perform Validation workflow starts.

    <end-time>: Time (in an epoch format) when the Perform Validation workflow ends.

    Yes

Back to top

Step 3: Updating module configurations

After creating a new module with the workflows required for the use case, you must now update the configuration for the following modules:

  • BMC-SA-Event_Orchestration_Configuration
  • AutoPilot-OA-Credentials_Store

Step 3.1 Add new event type in the BMC-SA-Event_Orchestration_Configuration module

  1. On the TrueSight Orchestration Development Studio Launch Pad, click Designer.
  2. In the Project Navigator tree, go to the BMC-SA-Event_Orchestration_Configuration module and open the module configuration. 
  3. In the Module Configuration area, go to Specifics > BMC_TrueSight > EventTypes and click to add a new module configuration group for the custom use case. 

    Note

    Event Types contains the use case specific configurations. For example, you see configurations for the out-of-the-box use cases – Service Down and Host Down.

  4. In the Group Name area, provide these details: 
    1. In the Name field, add the name of the new use case for which you want to add the triage and remediation actions. 
      Do not use special characters or spaces while specifying the use case name. 

    2. Save changes. 
  5. Under the newly created use case configuration group, add the following configuration items: 
    1. Add a new XML configuration item with the name Configurations using the following format.

      <configurations>
        <configuration>
          <id>1</id>
          <action-name></action-name>
          <incident-enabled></incident-enabled>
          <change-enabled></change-enabled>
          <change-template-name />
          <remediation-enabled>true</remediation-enabled>
          <change-type></change-type>
        </configuration>
      </configurations>

      XML elements for the Configurations item.

      1. <id>: Specifies the action ID; in case of a single action, start with 1.
      2. <action-name>: Specifies the name of the action that will appear on the TrueSight Presentation Server UI via the Launch Orchestration Actions menu. Example: For the out-of-the-box service down use case, the action-name is specified as Restart Service.
      3. <incident-enabled>: Specify whether to enable incident management integration from TrueSight Orchestration. Valid values: true, false (default; assuming BSR integration is enabled).
      4. <change-enabled>: Specify whether to enable change integration. Valid values: true, false (default)
      5. <change-template-name>: If <change-enabled> is true, specify the name of the change template to be used to create a change ticket. 
      6. <change-type>: If <change-enabled> is true, specify the type of change to be created in the change management system. Valid values: normal (default), emergency 
      7. <remediation-enabled>: Specify whether to enable remediation actions for this event type. 
        If true, you must ensure that the remediation workflow is created for this use case. If false, only triage action is performed for the event type.

        You can always add more than one action for a given use case. In the following configurations example, two actions are specified for the use case. 

        Note

        The action-names specified here appear in the Launch Orchestration Actions menu on the TSPS UI.

        Example for multiple actions
    2. Save changes.
    3. Add a new configuration item with the name ModuleName and provide the name of the module that you created in Step 1. Add a colon mark " " before the module name.
      Example: :BMC-SA-Event_Orchestration_Service_Down
    4. Save changes.

Back to top

Step 3.2 To add new adapters and invocation mechanism mappings required for the use case

  1. From the BMC-SA-Event_Orchestration_Configuration module configuration, go to Specifics > Adapters
    The adapters used by the out-of-the-box use cases – Service Down and Host Down are displayed. If new use cases requires any other adapters apart from the ones listed, add the new adapters here. Any new adapters added here must be configured and enabled on the grid. 
  2. To add a new adapter, do this: 
    1. Click (Add new module config item) and on the item details area, in the Name field, specify the name of the config item. For example, if you are using the HTTP adapter for your use case, enter HTTPAdapter. 
    2. In the Value field, specify the exact name of the HTTP adapter as it appears on the CDP. 

      Note

      The adapters that you specify here must be configured and enabled on the grid.

    3. Follow a. to c. to add any new adapters required for the use case. 
  3. After successfully adding the adapters, you now provide the adapter invocation mechanism mappings that are used by the AD Utilities and Common Utilities workflows for the new adapters.
    1. From the BMC-SA-Event_Orchestration_Configuration module configuration, go to Specifics > Adapters
    2. In the Adapter_Invocation_Mechanism_Mappings configuration item, add the adapter invocation mechanism for any new adapters in the following format: 
      <adapter-name invocation-mechanism="<invocationmechanism>"><ModuleConfigurationLabelForAdapterInvocation></adapter-name> 
      For example, for the HTTPAdapter, you can specify <adapter-name invocation-mechanism="http">HTTPAdapter</adapter-name> as the adapter invocation mechanism. 

Step 3.3 To enable incident integration from TrueSight Orchestration

By default, incident integration is assumed to be implemented. In the BMC-SA-Event_Orchestration_Configuration module configuration, under Specifics > BMC_TrueSight, the value for the IncidentIntegrationEnabled is set to true.

Perform the following steps to enable incident integration from TrueSight Orchestration:

  1. Go to Specifics > BMC_TrueSight > <New use case configuration item> and in the Configurations field, specify the <incident-enabled> parameter to true.
  2. Go to Specifics > BMC_AR_System and verify whether the default configuration settings in the following configuration groups is valid and matches your requirement and update as required: 
    1. IncidentManagementDefaults
    2. Mappings 
  3.  In the WebServiceConnectionData provide the details for connecting to BMC Remedy ITSM instance: 
    1. In the URL field, specify the mid-tier URL for BMC Remedy ITSM in the following format: 
      http://MIDTIER-HOST:MIDTIER-PORT/arsys/services/ARService?server=AR-SERVER-HOST

    2. In the Username, specify the user that has permissions to create change and incidents in BMC Remedy ITSM.
    3. In the Password, specify the password, in an encrypted format that matches the username. 
  4. Verify whether the values in these fields matches your ITSM environment and update if required:
    1. ITSMTimeZone
    2. ITSMLocaleCountry
    3. ITSMLocaleLanguage

Step 3.4 To enable change integration

Perform the following steps to enable incident integration from TSO:

  1. From the BMC-SA-Event_Orchestration_Configuration module configuration, go to Specifics > BMC_AR_System.
  2. Verify whether the default configuration settings in the following configuration groups is valid and matches your requirement and update as required: 
    1. ChangeManagementDefaults
    2. Mappings
  3. If you want to use templates to create change, go to BMC_AR_System > Templates and provide the change templates names in the XML format. 

    <templates>
      <template eventType="Default">Event Orchestration Change Template</template>
      <template eventType="ServiceDown">Event Orchestration Default Service Down Template</template>
    </templates>
  4.  In the WebServiceConnectionData provide the details for connecting to BMC Remedy ITSM instance. 
    1. In the URL field, specify the mid-tier URL for BMC Remedy ITSM in the format shown in the config. 
      Sample URL: http://MIDTIER-HOST:MIDTIER-PORT/arsys/services/ARService?server=AR-SERVER-HOST

    2. In the Username field,  specify the user that has permissions to create change and incidents in BMC Remedy ITSM.
    3. In the Password specify the password, in an encrypted format that matches the username. 
  5. Verify whether the values in these fields matches your ITSM environment and update if required:
    1. ITSMTimeZone
    2. ITSMLocaleCountry
    3. ITSMLocaleLanguage

Back to top

Step 3.5 Update AutoPilot-OA-Credentials_Store module

Credentials store module stores passwords used to connect to target servers to perform triage and remediation actions. In addition it also stores invocation mechanism (whether to use Windows specific adapter, SSH adapter, SQL adapter, and so on). 

  1. From the AutoPilot-OA-Credentials_Store module, go to the module configuration and verify the credentials for the following entities: 
    • DatacenterCredentials
    • PatrolAgentCredentials
    • WindowsCredentials
    • UnixCredentials
    • DatabaseCredentials
  2. In the ComponentTypeToOSMappings configuration item, specify the mappings for the operating systems from where events are generated. 

    Default ComponentTypeToHostOS mappings
    <mappings>
      <component-type name="NT_SERVICES">windows</component-type>
      <component-type name="NUK_Process">unix</component-type>
      <component-type name="NT_REMOTE_HOST">windows</component-type>
      <component-type name="NUK_LINUX_REMOTE_HOSTS">unix</component-type>
    </mappings>

    Important

    Ensure that you specify the <component-type name> as the value specified for the event object class used in the event.


  3. In the InfrastructureMappings configuration item, specify the mappings for the hosts used for the Event Orchestration run book. 

    Default InfrastructureMappings

Back to top

Step 4: Configuring and activating TrueSight Orchestration content

After updating the module configurations, you export the modules from the Development Studio to the repository and activate the modules on the TrueSight Orchestration Grid Manager. You must also activate the new use case module that contains workflow processes for the new use case. Activating a module deploys it to the grid. 

  1. To enable adapters required for the use case, do these steps:
    1. In the Grid Manager application, select the Manage tab, and then select the Adapters tab.
      The table on the left of the page displays all the adapters in the repository.
    2. From the list, select the adapters required for your use case and click Add to Grid.
    3. From the list of Adapters on Grid, click Configure to configure the adapters required for your use case.
    4. To enable adapters configured on the grid, select the Manage tab, and then select the Peers tab.
    5. Select the peer where you want to enable the adapter; then click the Edit selected Peer icon.
    6. In the New Adapters section of the Current Operation: Edit a Peer Configuration window, click Enable.
    7. Select the adapters that you want to enable, and then click OK.
  2. To export the modules to the repository, do these steps:
    1. On the TrueSight Orchestration Development Studio Launch Pad, click the Library Manager button.
    2. In Library Manager, click the Export Modules tab.

    3. In the Export Modules table select the modules to export by clicking in the Export check box next to the module name.

    4. Click the Export to Repository button.

    5. On the Export Confirmation window, verify the information and click Proceed.

      When the export workflow is finished, the Export Confirmation window disappears, and TrueSight Orchestration Development Studio displays the message Export Successful in the bottom left corner of the window. You can now see the modules on the Grid Manager. 

  3. To activate modules in the the Grid Manager application, do these steps: 
    1. In the Grid Manager application, select the Manage tab, and then select the Modules tab. 
      The table on the left of the page displays all the modules in the repository.
    2. From the list of modules, activate the following modules on the grid:
      • BMC-SA-Event_Orchestration_Configuration
      • AutoPilot-OA-Credentials_Store
      • BMC-SA-Event_Orchestration_<name_of_the_use_case>
    1. Click Activate
      The modules that you selected are activated on the grid.

Back to top

Step 5: Creating Orchestration Policies for running Orchestration actions

Now that you have performed the steps required to add a custom use case in TrueSight Orchestration, you need to create an Orchestration policy in TrueSight Presentation Server. 

When you create a custom use case on TrueSight Orchestration, associated custom Orchestration actions are enabled on all the events (irrespective of context) on the TrueSight console. If you run such an Orchestration action from a relevant event, it works as needed. However, you need to be careful about running such custom Orchestration actions. For example, you cannot run a custom Orchestration action for upgrading the RAM of a server from a critical event indicating insufficient disk space. 

To avoid analyzing events every time before running a custom Orchestration action, you can create an Orchestration policy and configure the event selection criteria. The event selection criteria determines the type of events on which an Orchestration action must be enabled. Also, in the policy, you can enable the Orchestration action to run automatically when a relevant event occurs and perform triage and remediation actions. 

Use the Configuration > Orchestration Policies page to view and manage a policy. For more information, see Managing Orchestration policies

Where to go from here

Now that you have successfully added a new custom use case, you can initiate Orchestration action, see  Using Orchestration actions to enable triage and remediation of events. Open link

Was this page helpful? Yes No Submitting... Thank you

Comments