Example: Enrich events according to the device status

Before you begin, make sure to create the custom enumeration and specify it as an attribute of the event class. For more information, see the following topics:

• Managing custom enumerations with REST APIs
• Managing events with REST APIs

To enrich the event severity, owner, and detailed message, perform the following steps:

1. Define the event selection criteria.
2. Build the policy workflow.

Actions used in the example

• If
• Enrich

For more information about actions, see Actions for advanced and time-based enrichment.

To define the event selection criteria

1. Select Configuration > Event Policies and click Create.
2. In the Event Selection Criteria, define a condition to select events from the class NAGIOS2_EV.

The following image illustrates how the event selection criteria will look:

To learn how to construct the event selection criteria, see Creating and enabling event policies.

To build the policy workflow

On the Advanced Enrichment page, perform the following steps to build the policy workflow:
The page .Example: Add operation note for event assignment vDec_2021 was not found  -- Please check/update the page name used in the MultiExcerpt-Include macro

1. Add the If action to check the status of the device. Assume that the custom enumeration device status has the following list of values:
   
   
   
2. If the device is down, in the Then part, add the Enrich action to enrich the event severity to critical.
   
   
   
3. Add the Enrich action to assign an owner for the event.
   
   
   
4. In the Else part, add the If action to check the status of the device.
   
   
5. If the device is up, add the Enrich action to enrich the detailed message in the event.
   

Results

The policy workflow enriches the severity, owner, and detailed message in the event as shown in the following images: