Out-of-the-box event policies and templates
The incident policies are executed when BMC Helix Operations Management is integrated with BMC Helix Integration Service. The deduplication policies deduplicate events to filter out unwanted and unnecessary events. For certain event policy types, you can use out-of-the-box policy templates that you can edit and customize.
Predefined Enrichment Policy for Incident
This policy is used for looking up CI information in BMC CMDB. It enriches the following slots based on the event class type. These slots fetch the CI ID, which is required for incident creation in BMC Helix IT Service Management.
- Component Alias
- CDM Class
- Instance Name
- Model Name
Predefined Notification Policy for Incident
This policy is applied in the following scenarios:
- If the policy is not configured in BMC Helix Operations Management, the policy is automatically created and enabled. This policy is configured with severity as CRITICAL.
- If the policy is configured in the system, but is not enabled, the policy is automatically enabled.
- If the policy is configured in the system and is enabled, the system uses this policy for PSR integration.
- If multiple notification policies for the incident are configured and enabled, the system processes incidents only according to the Predefined Notification Policy for Incident.
Event deduplication policies
Based on the dedup slots for event classes, events are deduplicated by using the out-of-the-box deduplication policies listed in the following table. A deduplication policy performs a lookup on existing unclosed events, drops the new event, and updates the existing event with the information from the new event.
Policy name | Event class | Dedup slot | Description | Existing event slots modified by the policy | |
|---|---|---|---|---|---|
AlarmEventProcessing | ALARM | al_alarm_id | Deduplicates an event of the ALARM class when the severity changes for the same metric. This policy updates the existing event (event is looked up by using the al_alarm_id slot) with the slot values of the new event and increments the repeat count for the event. This policy is invisible and you cannot edit it. |
| |
AlarmEventCloseProcessing | ALARM | al_alarm_id | Updates the status of the existing open event to Closed after a metric value returns to a normal state following a threshold breach and a Closed alarm event is received for the metric. The logs for event closure are logged on the Logs & Notes tab of an event. The event is looked up by using either the al_alarm_id slot, or the al_parameter_name and object_id slots together. This policy is invisible and you cannot edit it. |
|
|
AnomalyEventDuplicateProcessing | ANOMALY | an_anomaly_id | Deduplicates an event of the ANOMALY class when the severity changes for the same metric. This policy updates the existing event (event is looked up by using the an_anomaly_id slot) with the slot values of the new event and increments the repeat count for the event. This policy is invisible and you cannot edit it. |
| |
AnomalyEventCloseProcessing | ANOMALY | an_anomaly_id | Updates the status of the existing open event to Closed after a metric value returns to a normal state following a threshold breach and a Closed anomaly event is received for the metric. The logs for event closure are logged on the Logs & Notes tab of an event. The event is looked up by using the an_anomaly_id slot. This policy is invisible and you cannot edit it. |
| |
SelfMonitoringEventDuplicateProcessing | HELIX_SM_EV | HELIX_SM_EV:HELIX_COMPONENT:source_identifier | Deduplicates the disconnect self-monitoring event of the HELIX_SM_EV class when an event for the same PATROL Agent is received. This policy updates the existing open disconnect event (event is looked up by using the source_identifier slot) and increments the repeat count for the event. This policy is invisible and you cannot edit it. |
| |
SelfMonitoringEventCloseProcessing | HELIX_SM_EV | HELIX_SM_EV:HELIX_COMPONENT:source_identifier | Deduplicates the connect or disconnect self-monitoring event of the HELIX_SM_EV class when an event for the same PATROL Agent is received . This policy closes the existing open event (event is looked up by using the source_identifier slot) and keeps the latest connect or disconnect event open. The logs for event closure are logged on the Logs & Notes tab of an event. This policy is invisible and you cannot edit it. | status = CLOSED | |
incidentinfoToOrgIncIdUpdateProcessing | INCIDENT_INFO | incident_relation_source | Enriches the incident ID in the existing event after receiving an INCIDENT_INFO event once an incident is created in BMC Helix IT Service Management. The existing event is looked up by using the incident_relation_source slot). This policy applies only if you have configured Proactive Service Resolution (PSR) integration. This policy is invisible and you cannot edit it. |
| |
incidentinfoEventDuplicateProcessing | INCIDENT_INFO | _identifier | When an incident in BMC Helix IT Service Management is updated, a corresponding new INCIDENT_INFO event with the same event ID is created in BMC Helix Operations Management. This policy deduplicates the new event by updating the existing event (event is looked up by using the _identifier slot) and increasing the repeat count for the event. This policy applies only if you have configured Proactive Service Resolution (PSR) integration. This policy is invisible and you cannot edit it. |
| |
incidentinfoStatusUpdateProcessing | INCIDENT_INFO | incident_relation_source | This policy applies to the existing event after receiving an event update for the INCIDENT_INFO class on incident cancellation in BMC Helix IT Service Management. The policy is applied only if the incoming event class is INCIDENT_INFO and the incident_status is Cancelled. The existing event is looked up based on the value of the incident_relation_source slot in the INCIDENT_INFO event. The logs for the policy execution are logged on the Logs & Notes tab of an event. | NA | |
LogAlertDuplicateProcessing | LOGALERT_EV | LOGALERT_EV:alert_id | Deduplicates an event of the LOGALERT_EV class when a new LOGALERT_EV event for the same alert is received. This policy updates the existing event (event is looked up by using the alert_id slot) with the slot values of the new event and increments the repeat count for the event. This policy applies only if you have configured the Helix Log analytics application. This policy is invisible and you cannot edit it. |
| |
DynatraceEventsDuplicateProcessing | DynatraceEvent | DynatraceEvent:_identifier | Deduplicates an event of the DynatraceEvent class when a new DynatraceEvent event with the same event identifier is received. This policy updates the existing event (event is looked up by using the _identifier slot) with the slot values of the new event and increments the repeat count for the event. This policy applies only if you have configured the Dynatrace connector from the Helix Intelligent Integrations application. This policy is invisible and you cannot edit it. |
| |
SituationEventDuplicateProcessing | Situation | _identifier | Deduplicates an event of the Situation class when a new event with the same event identifier is received. This policy updates the existing event (event is looked up by using the _identifier slot) with the slot values of the new event and increments the related event count. This policy is applicable only if you have enabled the AiOps situations feature in the Helix Service Monitoring application. This policy is invisible and you cannot edit it. |
| |
PatrolEventsDuplicateProcessing | PATROL_EV |
| Deduplicates an event of the PATROL_EV class when a severity change event for the same metric is received from the PATROL Agent. This policy updates the existing event (event is looked up by using the dedup slots listed for the event class) with the slot values of the new event and increments the repeat count for the event. p_class indicates when a dedup event is generated. If the value of p_class equals 11, it indicates a threshold breach. For example, when the event severity is CRITICAL or MAJOR. If the value of p_class equals 9, it indicates that the threshold has returned to the normal state. For example, when the event severity is OK. The system only support p_class=11 for deduplication. Any other value for this attribute is not considered for deduplication. This policy is invisible and you cannot edit it. |
| |
PatrolEventsCloseProcessing | PATROL_EV |
| Updates the status of an existing PATROL event from Open to Closed after an incoming PATROL event with the severity OK is received. The logs for event closure are logged on the Logs & Notes tab of an event. The event is looked up by using the dedup slots listed for the event class. The policy drops the new incoming event with the severity OK. This policy is invisible and you cannot edit it. | status | |
PredictionEventClose | Prediction | pr_prediction_id | Closes the existing prediction event after the threshold violation ends and the prediction service generates a closed prediction event. The logs for event closure are logged on the Logs & Notes tab of an event. | status | |
Update Old Events - BMC Helix Intelligent Integrations This policy is created when you use BMC Helix Intelligent Integrations for the first time to fetch events from any third-party source supported by BMC Helix Intelligent Integrations. | IIMonitor |
| Deduplicates an event of the IIMonitorEvent class when a new event with the same event identifier and message is received. This policy updates the existing event (event is looked up by using the multiple slot values) with the severity of the new event and increments the repeat count for the event. It also updates the old event with the notes containing the event ID of the dropped event. This policy is visible and disabled by default. You can enable and edit it as required. |
| |
Update AWS CloudWatch Events - BMC Helix Intelligent Integrations This policy is created when you use BMC Helix Intelligent Integrations for the first time to fetch events from AWS CloudWatch. | AWSCloudWatchAlarm |
| Deduplicates an event of the AWSCloudWatchAlarm class when a new event for the same metric and entity is received. This policy updates the existing event (event is looked up by using the multiple slot values) with the slot values of the new event. It also updates the old event with the notes containing the event ID of the dropped event. This policy is visible and enabled by default. You can edit it as required. |
| |
Update Azure Events - BMC Helix Intelligent Integrations This policy is created when you use BMC Helix Intelligent Integrations for the first time to fetch events from Azure.
| AzureAlarm |
| Deduplicates an event of the AzureAlarm class when a new event for the same metric and entity is received. This policy updates the existing event (event is looked up by using the multiple slot values) with the slot values of the new event. It also updates the old event with the notes containing the event ID of the dropped event. This policy is visible and enabled by default. You can edit it as required.
|
| |
Update IBM Netcool Events - BMC Helix Intelligent Integrations This policy is created when you use BMC Helix Intelligent Integrations for the first time to fetch events from IBM Netcool.
| NetcoolEvent |
| Deduplicates an event of the NetcoolEvent class when a new event for the same metric and entity is received. This policy updates the existing event (event is looked up by using the multiple slot values) with the slot values of the new event. It also updates the old event with the notes containing the event ID of the dropped event. This policy is visible and enabled by default. You can edit it as required.
|
|
Event suppression policy
In a suppression policy, the event selection criteria determines which events are selected for suppression. The selected events are permanently dropped. Dropped events are not ingested and therefore not available on the Events page. Event notes are not enriched using this policy.
Policy name | Event class | Dedup slot | Description | Existing event slots modified by the policy |
|---|---|---|---|---|
Drop Duplicate Events - BMC Helix Intelligent Integrations This policy is created when you use BMC Helix Intelligent Integrations for the first time to configure an integration with any third-party source. | IIMonitor |
| Drops the new event if the old event is of the same type as the new event, based on the multiple slot values. This policy is visible and enabled by default. You can edit it as required. | None |
Event closure policy
In the closure policy, the event selection criteria determines which events are selected for closure. The selected events are permanently closed. Closed events remain in the system, and therefore available on the Events page. Event notes are enriched using this policy.
Closure policy name | Event class | Slot | Description | Existing event slots modified by the policy |
|---|---|---|---|---|
Close Old Catchpoint Events - BMC Helix Intelligent Integrations This policy is created when you use BMC Helix Intelligent Integrations for the first time to configure an integration with Catchpoint. | CatchpointAlert |
| Creates a new event and closes the old event if an incoming event contains the results of same test on the same node as an existing event. This policy is visible and enabled by default. You can edit it as required. | None |
Out-of-the-box policy templates
Out-of-the-box policy templates with predefined event selection criteria are available that help you to process events and set up routine event-management actions.
You can edit and customize an out-of-the-box policy template as per your requirement. However, if you choose a different class name, the predefined advanced enrichment configurations are reset.
By default, the policy templates are disabled. Enable the policies after you edit them as per your requirement.
The following table describes the out-of-the-box policy templates and their predefined criteria:
Out-of-the-box templates | Description |
|---|---|
Template for Basic and Advanced Enrichment |
|
Template for Closing Events and Dropping Duplicate Events |
|
Template for Timeout Policy And Notification |
|
Template for Event Suppression |
|