Will Severity populate on the event form for OOB SolarWinds event connectors

Go to solution
Madhan27
Mega Guru

3 weeks ago

Hi Community,

I’ve integrated SolarWinds using the Integration Launchpad, but the severity field is not populating on the Event form. In the processing notes, I can see that it’s invoking the event rule “SolarWinds Icon Severity”, which maps Icon (Source) to Severity (Target) as shown in the screenshot.

The incoming alerts appear to map severity correctly based on the defined field mapping.

My question is: Should that severity value also populate on the Event form, or is it only used within the rule processing?


TIAimage (1).pngimage.png

#ITOM # EventManagement 

 

Labels:
0 Helpfuls
  • 531 Views
1 ACCEPTED SOLUTION

Go to solution
sayalishinde
Tera Contributor

2 weeks ago

Hello @Madhan27


This is expected for the out-of-box SolarWinds connector. `solarwinds-icon-severity` does not populate Severity on the Event form.

That rule runs after event-rule processing and before the alert is created. It reads `icon` from Additional information and maps it to a severity for the alert. The Event record keeps whatever severity SolarWinds sent. If the payload has no severity, the Event form stays -- None --, even when Processing notes show the rule was applied.

 

In your screenshot this is working correctly. Additional information has "icon":"Green", and that pair maps Green to 5 (OK). Resolution state Closing fits a clear event. Check the linked alert for the result. A closing event closes the alert and usually keeps the alert’s previous severity for reporting, instead of replacing it with 5.

 

If other SolarWinds events show Critical, Major, OK, or Clear, that value came in with the event. This rule does not write Severity onto the event, so it also does not overwrite a severity that is already there. It only maps `icon` for the alert. The out-of-box pairs use 1 through 5 only, so a value of Clear on the event also came from the source, not from this rule.

 

Hope this helps! Please mark it as helpful if it worked for you.

View solution in original post

1 REPLY 1

Go to solution
sayalishinde
Tera Contributor

2 weeks ago

Hello @Madhan27


This is expected for the out-of-box SolarWinds connector. `solarwinds-icon-severity` does not populate Severity on the Event form.

That rule runs after event-rule processing and before the alert is created. It reads `icon` from Additional information and maps it to a severity for the alert. The Event record keeps whatever severity SolarWinds sent. If the payload has no severity, the Event form stays -- None --, even when Processing notes show the rule was applied.

 

In your screenshot this is working correctly. Additional information has "icon":"Green", and that pair maps Green to 5 (OK). Resolution state Closing fits a clear event. Check the linked alert for the result. A closing event closes the alert and usually keeps the alert’s previous severity for reporting, instead of replacing it with 5.

 

If other SolarWinds events show Critical, Major, OK, or Clear, that value came in with the event. This rule does not write Severity onto the event, so it also does not overwrite a severity that is already there. It only maps `icon` for the alert. The out-of-box pairs use 1 through 5 only, so a value of Clear on the event also came from the source, not from this rule.

 

Hope this helps! Please mark it as helpful if it worked for you.