Managing Orchestration policies

When you create a custom use case on TrueSight Orchestration, associated custom Orchestration actions are enabled on all the events (irrespective of context) on the TrueSight console. If you run such an Orchestration action from a relevant event, it works as needed. However, you need to be careful about running such custom Orchestration actions. For example, you cannot run a custom Orchestration action for upgrading the RAM of a server from a critical event indicating insufficient disk space. 

To avoid analyzing events every time before running a custom Orchestration action, you can create an Orchestration policy and configure the event selection criteria. The event selection criteria determines the type of events on which an Orchestration action must be enabled. Also, in the policy, you can enable the Orchestration action to run automatically when a relevant event occurs and perform triage and remediation actions. 

Use the Configuration > Orchestration Policies page to view and manage a policy. By default, Solution Administrators have full access to all policies in all realms (tenants). Tenant Administrators have full access to all policies in their realm (tenant). 

Before you begin

Ensure that you have already added the custom use case for the custom Orchestration action. For more information, see Add a custom use case to enable Orchestration actions

Out-of-the-box Orchestration policies

The following table lists the supported out-of-the-box Orchestration policies. You can use these policies to initiate Orchestration actions for different types of use cases.

The policies with "via TSSA" in the name run Orchestration actions that are performed using the TrueSight Server Automation NSH commands instead of the TrueSight Orchestration adapters. This ensures that even if the credentials of the target server are unknown, the services are restarted with the TrueSight Server Automation agents.

For more information about each of the use cases, see Orchestration actions.

These policies are editable and can be customized as per your needs.

To create an Orchestration policy

1. Go to Configuration > Orchestration Policies and click Create Policy.

2. In the Create Orchestration Policy page, specify the following details and click Save.

To edit an Orchestration policy

1. On the Configuration > Orchestration Policies page, select a policy. 
2. From the policy action menu, select Edit.
3. Change the configuration details provided while creating the policy and click Save.
   

To view an Orchestration policy

On the Configuration > Orchestration Policies page, click the policy name.

Alternatively, select a policy. From the policy action menu, select View.

To enable or disable an Orchestration policy

1. On the Configuration > Orchestration Policies page, select one or more policies.
2. Do one of the following:
   • To enable a policy: From the policy action menu or from the common action menu, select Enable or Disable as required.
   • To enable multiple policies: From the common action menu, select Enable or Disable as required.

To delete an Orchestration policy

1. On the Configuration > Orchestration Policies page, select one or more policies.
2. Do one of the following:
   • To delete a policy: From the policy action menu or from the common action menu, select Delete and click Yes.
   • To delete multiple policies: From the common action menu, select Delete and click Yes.

To enable or disable automation of the Orchestration action in the policy

1. On the Configuration > Orchestration Policies page, select one or more policies.
2. Do one of the following:
   • To enable automation for a policy: From the policy action menu or from the common action menu, select Enable Automation or Disable Automation as required.
   • To enable automation for multiple policies: From the common action menu, select Enable Automation or Disable Automation as required.

Fields and options on the Orchestration Policies page

The following figure highlights the various fields and options that are available on the Orchestration Policies page.

Where to go from here

After verifying that the custom Orchestration action is getting displayed correctly, you can directly initiate the Orchestration action to perform triage or remediation based on your use case. For more information about initiating Orchestration actions, see Using Orchestration actions to enable triage and remediation of events.