Example: Enrich events according to the device status
Before you begin, make sure to create the custom enumeration and specify it as an attribute of the event class. For more information, see the following topics:
To enrich the event severity, owner, and detailed message, perform the following steps:
Actions used in the example
For more information about actions, see Actions for advanced and time-based enrichment.
To define the event selection criteria
- Select Configuration > Event Policies and click Create.
- In the Event Selection Criteria, define a condition to select events from the class
The following image illustrates how the event selection criteria will look:
To learn how to construct the event selection criteria, see Creating and enabling event policies.
To build the policy workflow
On the Advanced Enrichment page, perform the following steps to build the policy workflow:
The page .Example: Add operation note for event assignment vDec_2021 was not found -- Please check/update the page name used in the MultiExcerpt-Include macro
- Add the
Ifaction to check the status of the device. Assume that the custom enumeration device status has the following list of values:
- If the device is down, in the
Thenpart, add the
Enrichaction to enrich the event severity to critical.
- Add the
Enrichaction to assign an owner for the event.
- In the
Elsepart, add the If action to check the status of the device.
- If the device is up, add the
Enrichaction to enrich the detailed message in the event.
The policy workflow enriches the severity, owner, and detailed message in the event as shown in the following images: