Managing Orchestration policies

When you create a custom use case on TrueSight Orchestration, associated custom Orchestration actions are enabled on all the events (irrespective of context) on the TrueSight console. If you run such an Orchestration action from a relevant event, it works as needed. However, you need to be careful about running such custom Orchestration actions. For example, you cannot run a custom Orchestration action for upgrading the RAM of a server from a critical event indicating insufficient disk space. 

To avoid analyzing events every time before running a custom Orchestration action, you can create an Orchestration policy and configure the event selection criteria. The event selection criteria determines the type of events on which an Orchestration action must be enabled. Also, in the policy, you can enable the Orchestration action to run automatically when a relevant event occurs and perform triage and remediation actions. 

Use the Configuration > Orchestration Policies page to view and manage a policy. By default, Solution Administrators have full access to all policies in all realms (tenants). Tenant Administrators have full access to all policies in their realm (tenant). 

Before you begin

Ensure that you have already added the custom use case for the custom Orchestration action. For more information, see  Add a custom use case to enable Orchestration actions

Out-of-the-box Orchestration policies

The following table lists the supported out-of-the-box Orchestration policies. You can use these policies to initiate Orchestration actions for different types of use cases.

These policies are editable and can be customized as per your needs.

For more information about each of the use cases, see  Orchestration actions.

To create an Orchestration policy

1. Go to Configuration > Orchestration Policies and click Create Policy.

2. In the Create Orchestration Policy page, specify the following details and click Save.

   Field	Description
   Name	Unique name to identify the policy.
   Enable Policy	(Optional) Indicates whether the policy is enabled or disabled. By default, the policy is disabled.
   Automate Orchestration Action	(Optional) Indicates whether the Orchestration action will run automatically. If you enable automation, when relevant events occur (determined by the event selection criteria), the selected Orchestration action is automatically run for triage and remediation purposes. Note: In the following scenarios, the actions will not be run automatically. In such scenarios, you can manually run the Orchestration action from the relevant events. If the Orchestration policy is disabled If the TrueSight Orchestration component is down  If a bulk of events are received at the same time
   Orchestration Action	Select the Orchestration action for which you want to configure event selection.
   Event Selection Criteria	Conditions to select events on which the policy is applied. To create conditions, you need to first select an appropriate class. The selection criteria consists of opening parenthesis, followed by the slot name, the operator, the slot value (which can be a string based on the type of slot selected), and the closing parenthesis. You can optionally select the logical operator AND or OR to add additional conditions.

To edit an Orchestration policy

1. On the Configuration > Orchestration Policies page, select a policy. 
2. From the policy action menu, select Edit.
3. Change the configuration details provided while creating the policy and click Save.
   

To view an Orchestration policy

On the Configuration > Orchestration Policies page, click the policy name.

Alternatively, select a policy. From the policy action menu, select View.

To enable or disable an Orchestration policy

1. On the Configuration > Orchestration Policies page, select one or more policies.
2. Do one of the following:
   • To enable a policy: From the policy action menu or from the common action menu, select Enable or Disable as required.
   • To enable multiple policies: From the common action menu, select Enable or Disable as required.

To delete an Orchestration policy

1. On the Configuration > Orchestration Policies page, select one or more policies.
2. Do one of the following:
   • To delete a policy: From the policy action menu or from the common action menu, select Delete and click Yes.
   • To delete multiple policies: From the common action menu, select Delete and click Yes.

To enable or disable automation of the Orchestration action in the policy

1. On the Configuration > Orchestration Policies page, select one or more policies.
2. Do one of the following:
   • To enable automation for a policy: From the policy action menu or from the common action menu, select Enable Automation or Disable Automation as required.
   • To enable automation for multiple policies: From the common action menu, select Enable Automation or Disable Automation as required.

Fields and options on the Orchestration Policies page

The following figure highlights the various fields and options that are available on the Orchestration Policies page.

Where to go from here

After verifying that the custom Orchestration action is getting displayed correctly, you can directly initiate the Orchestration action to perform triage or remediation based on your use case. For more information about initiating Orchestration actions, see  Using Orchestration actions to enable triage and remediation of events.