Rule Based Alert Correlation

[Powshika B]

Hi,

Requirement: If there is any open existing alert with the same values, make existing alert as primary and the current alert as secondary. similarly, If the existing alert is closed, the existing alert should reopen and so the incident if another alert comes in with the same values.

In my case the existing alert is reopening but instead of reopening the existing incident, it is creating new incident. Why is it working so?

SCRIPT:

(function findCorrelatedAlerts(currentAlert) {

    var result = {};

    // Define the fields for comparison from the new alert record

    var newNode = current.node;

    var newCI = current.cmdb_ci.sys_id;

    var newSourceInstance = current.event_class;

    // Query to find existing alerts with the same node, CI, source instance, and state not equal to 'closed'

    var existingAlert = new GlideRecord('em_alert');

    existingAlert.addQuery('node', newNode);

    existingAlert.addQuery('cmdb_ci.sys_id', newCI);

    existingAlert.addQuery('event_class', newSourceInstance);

    existingAlert.addQuery('description', 'CONTAINS', newNode);

    existingAlert.addQuery('correlation_rule_group', 'IN', '0,1');

    existingAlert.addQuery('state', '!=', 'closed');

    existingAlert.query();

    if (existingAlert.next()) {

        // If an open alert with the same values is found, correlate it as a primary alert

        result = {

            'PRIMARY': [existingAlert.getUniqueValue()],

            'SECONDARY': [currentAlert.sys_id]

        };

    } else {

        // If no open alerts with the same values are found, check for closed alerts within the last 4 hours

        var closedAlert = new GlideRecord('em_alert');

        closedAlert.addQuery('node', newNode);

        closedAlert.addQuery('cmdb_ci.sys_id', newCI);

        closedAlert.addQuery('event_class', newSourceInstance);

        closedAlert.addQuery('description', 'CONTAINS', newNode);

        closedAlert.addQuery('state', 'closed');

        closedAlert.addNotNullQuery('incident');

        closedAlert.addQuery('sys_updated_on', '>', gs.hoursAgo(4)); // Check within the last 4 hours

        closedAlert.orderByDesc('sys_updated_on'); // Order by most recent updated time

        closedAlert.query();

        if (closedAlert.next()) {

            // If a closed alert within the last 4 hours is found, reopen it and correlate it as a primary alert

            closedAlert.state = 'Reopen';

            closedAlert.update();

            result = {

                'PRIMARY': [closedAlert.getUniqueValue()],

                'SECONDARY': [currentAlert.sys_id]

            };

        } else {

            // If no matching alerts are found, set the current alert as the primary alert

            result = {

                'PRIMARY': [currentAlert.sys_id],

                'SECONDARY': []

            };

        }

    }

    return JSON.stringify(result);

})(currentAlert);

[Powshika B]

Filter conditions are based on alert data's or event data's coming from Monitoring Source?

[arjun19]

Hi @Powshika B , did you find out any reason why its not working.

Thanks 

[Powshika B]

Hi @arjun19 , It's working only for the open alerts and not for closed alerts to reopen. I didn't find the solution yet.

[arjun19]

Thanks for your reply, I am trying to be creating the Alert correlation rule, but it is not working as expected.

do we need to enable any alert correlation properties for this.

[Powshika B]

Hi @Rahul Priyadars , Can we group alerts using business rule? Because its not working when I tried. PFA the script for your reference.