Creating automation policies

Automation policies execute actions that remediate issues identified by the events generated in BMC Helix Operations Management or BMC Helix AIOps. 

As an automation engineer, you can create automation policies for frequently occurring issues such as service down or disk space utilization or based on incoming requests for automation. A policy can be triggered automatically (when an event matches the trigger condition specified in the policy), or manually, (as automation actions in BMC Helix Operations Management or BMC Helix AIOps). 

Automation policies contain one or more actions that connect with the automation applications supported by BMC Helix Intelligent Automation to perform remediation actions for events. 

To create an automation policy

Perform the following steps to create an automation policy. 

Step 1: To provide the policy information and specify the execution mode

  1. In the BMC Helix Intelligent Automation console, go to Policies and click Create Automation Policy.
  2. In the Policy Information section, enter a unique name and an optional description for the policy. 
  3. Select the execution mode as Manual or Automatic depending upon whether you want to execute the policy manually or automatically based on the incoming events.

    Can I change the execution mode later?

    Yes, you can edit the policy and change the mode anytime.

Step 2: To define the trigger condition to match the incoming event

  1. In the Trigger section, click Browse, and do one of the following:
    • From the Select Event Type tab, select an existing event type and click Done.
      The trigger condition from the event is listed in the following format: <eventCategory>: <eventName>.


      Where do these event types come from?

      Out of all incoming events, BMC Helix Intelligent Automation shows the latest event for each event type (in case of multiple events of the same type but with different values). 

      Why don't I see any existing event types to choose from? 

      Out of a huge number events, BMC Helix Intelligent Automation chooses events from each type randomly as a sample. Hence, either the product has not received any events from the source or it may take a while for the event types to be listed.

    • On the Paste Event JSON tab, enter the event information in the JSON format, and click Done.
    When you select an event, all parameters in the event appear in the right pane. 
  2. Click anywhere in the Trigger Condition box to start building the expression for a trigger condition, and use the suggested parameters, values, and operators to complete the expression.
    For sample expressions, see Trigger condition expression

Step 3: To select actions to be run as part of the policy

  1. To add action to the policy, click Add Action and perform the following steps using the action wizard:

    1. From the Pick an automation tool section, click the connector name.
      Only configured connectors are displayed here. The wizard takes you to the next step to select an action. 

    2. Click Sync Actions
      All actions available in the selected connector appear. 
    3. Click Select against the action that you want to add to the policy.
      The wizard takes you to the next step to configure an action.
    4. Depending on the selected action, provide the information and click Done.


      Based on the selected event, the event slots with the values specified in the event appear under the Parameters section on the UI. You can click any of the parameters and its value gets copied. You can paste it while defining the action in the policy. 

      The added action appears in the Action Configuration section. You can add multiple actions in a policy. 

      Adding action for supported applications

      To add action for a specific automation application, see the following documentation for an example for each of the supported connections:

Step 4: To add tags

  1. To add system or custom tags to the policy, perform the following steps:
    1. System tags: Select one or more tags from the list of available system tags. 
      Based on the event, some system tags are displayed.
    2. Custom tags: In the Tags (Optional) section, enter a key-value pair. 
      Tag key should start with an alphabet and end with an alphanumeric character. Key supports alphanumeric characters and periods, dashes, and underscores. 

Step 5: To configure change management for creating change requests 

To create a change request as part of this policy, perform the following steps:

  1. If not enabled already, use the Enable change ticket creation toggle button and then click Modify to add change request values. 
  2. Select the appropriate values for the following fields and click Save

    1. Impact
    2. Urgency
    3. Company
    4. First Name: By default, first and last name of the logged-in user appears. 
      When you enter the first name, based on the selected company, the list of user names belonging to that company appear in a list in the <username-firstname-lastname> format. If there are multiple users with the same first name, you can select the correct user from the list. When you select the first name, the last name gets selected. 
    5. Last Name
    6. Description: By default, contains the name of the product, BMC Helix Intelligent Automation. The description is updated in the Summary field in the change request in BMC Helix ITSM. Ensure that the description is up to 100 characters only. 
      The selected values are displayed. When a change is created in BMC Helix ITSM, it will contain the values specified in the policy.


      In case the user credentials for the BMC Helix ITSM get changed for the tenant, it takes 15 minutes to reflect the changes in BMC Helix Intelligent Automation. In this time period, if the the policies with change management options are triggered, they fail and display an authentication failed error. After 15 minutes, if the policies are triggered again, they will successfully run.   

      After the change request is approved in BMC Helix ITSM, the policy is triggered and runs the actions. 

Step 6: To provide estimated savings

  1. In the Estimated Savings section, enter an approximate time (in minutes) and money (in USD) that you may save by automating the actions. 
  2. Continue to the next step

Step 7: To configure notifications and publish the policy

By default, the Generate Information Event on execution check box is selected. Every time this policy runs, an information event (AUTOMATION_STATUS_EV class) is generated in BMC Helix Operations Management.


  • Do not specify the AUTOMATION_STATUS_EV class in the trigger condition especially if using the automatic execution mode because it might create infinite loops of the incident process, thus creating event noise.  
  • For policies that are already created, information events are generated in BMC Helix Operations Management. If you do not want the information events, edit a policy and clear the check box. 
  • If you clear the check box: 
    • Policy execution is not counted in the Automation Runs count in BMC Helix Intelligent Automation Value Dashboard. For more information, see Viewing policies in BMC Helix Dashboards.
    • If users run this automation policy from BMC Helix AIOps, the status of the policy in BMC Helix AIOps still shows Running even if the policy may have run successfully.  
  • If you do not want to generate information events of the type Automation_Status_EV in BMC Helix Operations Management for the out-of-the-box policies created as part of solutions (Blackout Policy or Proactive Service Resolution), then you must configure the solution again. If you configure the solution again, automation status information events are not generated. 

Select Publish Policy and click Save.

(Optional step) To test the policy

When creating a policy, you can select an event from the list of events that have occurred in BMC Helix Operations Management. BMC Helix Intelligent Automation listens to BMC Helix Operations Management over a period of time and shows a list of event types to make it easy to build policies. For testing, BMC Helix Intelligent Automation uses the event data selected as part of the policy creation process. It does not create a new event, or wait for a new event coming from BMC Helix Operations Management. You can test a policy with the parameters specified in the policy or update the parameter values to test a policy. 


Changing the trigger conditions to test a policy may cause the policy to fail during testing if the new conditions don't match the stored event type. For example, if you select a "Service Down" event to create a policy, BMC Helix Intelligent Automation uses a "Service Down" event stored in the product. If you change the trigger conditions, the test may fail if they don't match the stored event.

  1. Click Test Policy.
    You are prompted to save the policy. 

  2. Click Confirm.
    On the Test Inputs tab, a list of event parameters is shown. You can select one or multiple parameters and update the value for the parameters to test the policy. 

  3. Click Execute
    The results appear in the Test Results tab. The values updated while testing the policy are not saved as trigger conditions, and the event JSON also does not get updated in the actual policy. 

    Can I test a policy later?

    Yes, however, you need to change a policy status to draft and edit the policy to test it. BMC recommends that you test a policy while creating it.

Trigger condition expression

To build a trigger condition expression, you can use the expression builder provided by BMC Helix Intelligent Automation  while creating an automation policy. To learn more, see Trigger condition

The following table lists sample conditions and the events that will match to those conditions:

ScenarioTrigger condition exampleDescriptionSample event
Service is down
( $.event.msg == 'SERVICES_Spooler Service status == 3 0 - Running, 1 - Ok not running, 2 - Warning not running, 3 - Alarm not running for 1 min.' ) && ( $.event.source_hostname == '' ) && ( $.event.class like_regex '^.*ALARM.*$' )
Matches any event where msg equals SERVICES_Spooler Service status == 3 0 - Running, 1 - Ok not running, 2 - Warning not running, 3 - Alarm not running for 1 min. and source_hostname equals the hostname specified in the condition, and the class contains ALARM.
    "msg": "SERVICES_Spooler Service status == 3 0 - Running, 1 - Ok not running, 2 - Warning not running, 3 - Alarm not running for 1 min.",
    "creation_time": 1598887988000,
    "_tenant_id": "1602985772",
    "incident_type": "",
    "al_baseline_weekly_low": "",
    "al_parameter_value": "3.0",
    "al_thresh_id": "NT_SERVICES:ServiceStatus:CRITICAL:1602985772:ALL",
    "modelname": "",
    "incident_operational_category1": "",
    "incident_operational_category2": "",
    "incident_operational_category3": "",
    "al_parameter_unit": "0 - Running, 1 - Ok not running, 2 - Warning not running, 3 - Alarm not running",
    "source_identifier": "bcc31a2d-****-****-****-ad4880bc2f71",
    "al_thresh_type": "USERDEFINED",
    "incident_id": "",
    "_service_id": "",
    "_operations": "[0x1744526ba09,admin,TSO CDP Service Down,Alarm (ALL),'']",
    "incident_company": "",
    "al_parameter_threshold": "3.0",
    "al_baseline_hourly_high": "",
    "details": "",
    "_modified_time": 1598888000442,
    "_notes": "[]",
    "al_event_score": "0",
    "al_avg_value": "",
    "al_old_severity": "UNKNOWN",
    "al_is_predicted": "FALSE",
    "al_alarm_id": "bcc31a2d-774e-4efe-99ec-ad4880bc2f71",
    "al_end_time": 4294967295000,
    "al_parameter_name": "ServiceStatus",
    "incident_category": "",
    "al_extremeness": 0,
    "priority": "PRIORITY_5",
    "object_id": "d7677983-953d-4554-88ee-168c1187891d:NT_SERVICES:SERVICES_Spooler",
    "al_thresh_above": "TRUE",
    "_node_id": "",
    "_identifier": "bcc31a2d-774e-4efe-99ec-ad4880bc2f71",
    "tags": "[]",
    "instancename": "",
    "_repeat_count": "0",
    "user_assigned": "",
    "componentalias": "",
    "al_pts_exceeded": "0",
    "al_baseline_daily_low": "",
    "al_highest_severity": "CRITICAL",
    "status": "OPEN",
    "object": "SERVICES_Spooler",
    "al_pts_total": "0",
    "sub_category": "OTHER",
    "al_baseline_daily_high": "",
    "al_last_time": "0",
    "_errors": "[]",
    "al_baseline_weekly_high": "",
    "_ci_id": "74ba8fda-fbf9-4f3b-a63b-decf23d5b776",
    "al_baseline_hourly_low": "",
    "source_address": "",
    "source_port": "0",
    "cross_launch_uri": "",
    "alias": [
    "al_device_ipaddress": "176620902",
    "class": "ALARM",
    "object_class": "NT_SERVICES",
    "_lifecycle_time": "0",
    "severity": "CRITICAL",
    "al_thresh_duration": 60,
    "incident_item": "",
    "_arrival_time": 1598888000442,
    "al_prediction_severity": "UNKNOWN",
    "cdmclass": "",
    "al_agent_os": "Windows Server 2012 R2 Standard",
    "_unmapped_data": {
        "al_baseline_type": null
    "al_agent_name": "vw-pun-bao-pt01",
    "al_predict_to_occur_time": "0",
    "al_agent_port": "3181",
    "_model": "",
    "location": "",
    "category": "OPERATIONS_MANAGEMENT",
   "source_hostname": ""

Overallocated containers
( $.event.tags.platform like_regex '^.*kubernetes.*$' ) && ( $.event.payload.resources[*].cluster like_regex '^.*vmcluster.*$' ) && ( $.event.payload.resources[*].namespace == 'adeint' )
Matches any event where the tags.platform contains kubernetes, payload.resources[*].cluster contains the name of the cluster and the payload.resources[*].namespace equals adeint.
    "tags": {
        "platform": "kubernetes"
    "payload": {
        "generated_by": {
            "product": "Optimize",
            "version": "21.05.00"
        "resources": [
                "resource_id": "?",
                "resource_name": "ade-reporting",
                "account_id": "?",
                "account_name": "?",
                "cluster": "aus-k8s-vmcluster",
                "namespace": "host1",
                "deployment": "adereporting",
                "current_cpu_request": 500,
                "current_cpu_limit": 1000,
                "current_memory_request": 2560,
                "current_memory_limit": 2560,
                "cpu_demand": 25,
                "cpu_demand_peak": 350,
                "memory_demand": 2227,
                "memory_demand_peak": 2227,     
                "tags": {
                    "Environment": [
                    "Department": [
                "container_cpu_recommendation": {
                    "action": "reduce_cpu_allocation",
                    "recommended_cpu_request": "200m",
                    "reclaimable_cpu": 450,
                    "recommended_cpu_limit": "500m"
                        "container_memory_recommendation": {
                    "action": "reduce_memory_allocation",
                    "recommended_memory_request": "128Mi",
                    "reclaimable_memory": 450,
                    "recommended_memory_limit": "1Gi"

Stop an Amazon EC2 instance
$.event.event_type like_regex '^.*ec2_stop.*$' && $.event.region_code == 'us-east-1'
Matches any event where the event_type field contains ec2_stop and the region_code is us-east-1.
Sample event for AWS EC2 instance
    "event_type": "aws-ec2_stop",
    "region_code": "us-east-1",
   "resource_id": "i-07a07b95f94e69673"

Where to go from here

After successfully creating policies, you can view the automation policies in the console, see Viewing, editing, and copying automation policies

Was this page helpful? Yes No Submitting... Thank you