Creating and enabling event policies

As an administrator, create and enable event policies to define the actions that the system takes after an event arrives. For events, you can create the following types of policies:

• Basic enrichment
• Suppression
• Advanced enrichment

• Dynamic enrichment

• Time-based enrichment
• Correlation
• Notification

To learn how to create some of these policies with examples, see the following topics:

• Example: Enriching basic event attributes and sending notifications

• Examples: Event policies for enrichment, correlation, notification, and suppression

• Example: Dynamically enriching events from an external file

To create an event policy

To create an event policy, perform the following steps:

1. Select Configuration > Event Policies and click Create.

2. Specify a unique name, optional description, and precedence number for the policy.

3. Create the event selection criteria based on which the policy is applied to the events.
   Values in the event selection criteria are case-sensitive. For example, Message Equals test and Message Equals TEST are considered as different values.

   Important

   For event and blackout policies, we do not recommend using the less than (<), greater than (>), and the ampersand (&) characters in the selection criteria.

    Constructing the selection criteria

   When you click in the box, you are prompted to make a selection. Each time you make a selection, you are progressively prompted to make another selection. 

   The selection criteria consist of an opening parenthesis, followed by the slot name, the operator, the slot value (which can be a string based on the type of slot selected), and the closing parenthesis. You can optionally select the logical operator AND or OR to add additional conditions. Specifying the opening and closing parentheses is optional.

   Example criteria: If you specify the following criteria, all the PATROL events with the "Open" status are selected and the policy is applied to them.

   The green tick mark indicates that the event selection criteria syntax is correct.

   
   

   For the slot value, you can specify global variables as shown in the following image:

   

   During execution of the policy, the global variable name is replaced with the variable value. For more information about global variables, see Information sharing between enrichment policies with global variables.

   You can also copy the criteria by clicking Copy . The copied criteria can be reused in subsequent policies by pressing Ctrl+V in the Event Selection Criteria field.

   About specifying the class

   A condition based on the class slot must be specified before any other condition. In the subsequent conditions, the list of slots change based on the class specified. The subsequently displayed slots are subclasses of the parent class selected in the first condition.

   For example, in the following image notice the list of slots specific to the selected Alarm class.

   

   
   

   The time frame for which the policy is always active.

4. Select one or more of the following policy types and configure them. The configured policy types are displayed in the policy evaluation order irrespective of the order in which they were configured. To know more about the policy evaluation order, see Event policy types and evaluation order.
   You can set up multiple configurations for certain policy types. Each configuration is displayed as a policy card as shown in the following screenshot. Reorder the policy cards by dragging and dropping them to change the configuration execution order within a specific policy type. 
   
   
   

   Slots configured in the event policy settings

   Some of the event policies allow you to define slots while configuring the policy settings. The list of these slots is restricted to the event class selected in the the event selection criteria. If no class is selected in the event selection criteria, the base EVENT class slots are displayed for selection.  

   Event policy type	Task	Reference
   Basic Enrichment	Select the required settings and specify the values. This policy helps you process events with refined slot values to make the events more meaningful.	Event enrichment for adding context
   Suppression	Automatically drop new events that are selected based on the event selection criteria. You do not require any configurations for this policy. Note: Applying this policy deletes all the matching events with missing dedup slot values. To avoid this scenario, ensure that all the events are updated with appropriate dedup values and then apply the suppression policy. You can update ingested events by running the events API endpoint. For more information, see Managing events with REST APIs.	Event deduplication and suppression for filtering unwanted events
   Advanced Enrichment and dynamic enrichment	Do one of the following: Build an advanced enrichment policy workflow. Import external data and update the match and enrich fields. An advanced enrichment policy helps you process events with refined slot values based on the defined policy workflow and make the events more meaningful. Dynamic event enrichment is an extension of advanced enrichment that allows you to enrich events with external data.	Event enrichment for adding context Building a policy workflow for advanced and time-based enrichment Dynamically enriching events with external data
   Time Based	Build a time-based enrichment policy workflow. This policy helps you process events with refined slot values after a scheduled duration of time and based on the defined policy workflow to make the events more meaningful.	Event enrichment for adding context Building a policy workflow for advanced and time-based enrichment
   Correlation	Select the required settings and specify the values. This policy helps you correlate and combine multiple matching events into a single aggregated event.	Event correlation for aggregating related events
   Notification	If the notification service is: Email, the policy notifies users via email that an event has occurred, so that appropriate actions can be taken. Incident, the policy is used for Proactive Service Resolution (PSR) integration. Select the required Email settings and specify the values. For some values you might want to specify slots.	Event-based notifications for alerting users Proactive Service Resolution (PSR) integration

5. Use the icons to edit or delete the configured policy types.

6. (Optional) Select Enable Policy.
   You can enable or disable the policy any time from the Event Policies page.
7. Save the policy.

To edit an event policy

On the Configuration > Event Policies page:

1. Do one of the following:
   
   • Select the policy and click Edit.
   • From the Actions menu of a policy, select Edit.
2. Edit the policy and save the changes.

To copy an event policy

On the Configuration > Event Policies page:

1. Click the action menu of the policy that you want to copy and select Copy. 
   The Create Event Policy page is displayed with the configurations of the copied policy. 
2. Modify the configurations according to your requirements to create a new policy quickly. 

To view the list of event policies

On the Configuration > Event Policies page, view the list of event policies.

By default, the policies are sorted by Name. To sort on a different column, click the column heading.

To enable or disable an event policy

On the Configuration > Event Policies page, do one of the following:

• Select the policy and click Enable or Disable.
• From the Actions menu of a policy, select Enable or Disable.
• Edit the policy and select or clear the Enable Policy check box.

To delete an event policy

On the Configuration > Event Policies page, do one of the following:

• Select one or more policies, click Delete, and click Yes.
• From the Actions menu of a policy, select Delete, and click Yes.