Skip to main content

What are EMS actions?

Elizabeth McKee
Updated

Applicable to Entuity v23.0 GA. If you are using an earlier version of Entuity, please see this article.

 

Standard actions

Custom actions

    Response Callback
    Send e-mail
    Send SNMP Trap
    Send to Big Panda
    Send to BMC Helix/Helix Queue
    Send to Moogsoft/Moogsoft Queue
    Send to ServiceNow/ServiceNow Queue
    Send to Slack/Slack Queue
    Send to Splunk/Splunk Queue

 

 

 

 

In Entuity, EMS actions define the operations that can be performed by event rules and incident triggers. You can select from preconfigured actions or defined new actions. You can also edit and delete actions.

There are two places in which you can specify action steps:

  • triggers - the incident triggers the action.
  • rules - rules are applied during the processing of events.

 There are two types of actions:

  • Standard Actions - these are the standard, system actions.
  • Custom Actions - these are custom actions that you can add to (e.g. through configuration changes to reflect integrations).

add_action_menu_full.png

 

 

Standard actions: 

Standard Action Description
Discard Event discards the current event. An example of its use is in the Pre-Storage rule, Filter Port Status Events, where trap-based events are not raised against ports where Status Events is set to No.
Set Attribute

you can set a value against a new or existing event/incident attribute. This enrichment is through 2 attribute types:

  • database attributes, which are stored in the database. These are visible in the Event Viewer, and available to forward to third-party integrations.
  • memory attributes, which exist only for the duration of the event processing. You can use them to pass values between rules.

You can assign static values to attributes, or access the database values, variables and function calls. For example, an event related to a device might look up the location of that device and include it in one of the event attributes.
Set Event Type allows you to change the event type. This action is used with the unify rules that are used in the default flapping solution.
Set Severity

enter the internal severity level values to reset the current event:

2 - Information or Cleared.

4 - Minor.

6 - Major.

8 - Severe.

10 - Critical.
Increase Severity increases the severity by one level.
Decrease Severity decreases the severity by one level.
Create Event generates a new event type, based on the selected event type and using the same source. This new event is processed in addition to the original event. Any of the standard attributes can be set and new ones defined.
Derive Event generates a new event type, based upon the selected event type and using the same source. This new event is processed in addition to the original event. For example, selecting Show Details on the derived event also shows the details of the original event.
Groovy Script expressions developed using Groovy Script (an object-oriented programming language for the Java platform). Through Groovy, you can access the database, e.g. the Filter Port Status Events rule evaluates whether Entuity is configured to raise status events against the current port.
Process allows Entuity to execute a process, utility or script as though it were run from the command line. You can pass parameters to a process using a configurable list of arguments.

 

 

Custom actions:

Named Action Description
Response Callback (Enuity v23.0 P01 upwards) performs an action upon receiving a response from a server/integration that has received forwarded events and incidents. 
Send e-mail sends an email containing event and incident attributes.
Send SNMP Trap sends SNMP traps generated from events and incidents to third-party trap receivers.
Send to Big Panda forwards events and incidents to BigPanda integration.
Send to BMC Helix forwards events and incidents to BMC Helix integration.
Send to Helix Queue (Enuity v23.0 P01 upwards) forwards events and incidents in queues from the Message Broker to BMC Helix integration.
Send to Moogsoft forwards incidents to Moogsoft integration.
Send to Moogsoft Queue (Enuity v23.0 P01 upwards) forwards incidents in queues from the Message Broker to Moogsoft integration.
Send to ServiceNow forwards incidents to ServiceNow.
Send to ServiceNow Queue (Enuity v23.0 P01 upwards) forwards incidents in queues from the Message Broker to ServiceNow.
Send to Slack forwards events and incidents to a specified Slack channel or channels.
Send to Slack Queue (Enuity v23.0 P01 upwards) forwards events and incidents in queues from the Message Broker to a specified Slack channel or channels.
Send to Splunk forwards events and incidents to Splunk integration.
Send to Splunk Queue (Enuity v23.0 P01 upwards) forwards events and incidents in queues from the Message Broker to Splunk integration.

 


Response Callback

As of Entuity v23.0 P01 upwards, the 'Response Callback' action lets you define an action to perform when a third party software server/integration responds to receiving event and incident messages from EMS. The 'Response Callback' action works with the 'callback' parameter in the custom queue actions (Send to Helix Queue, Send to ServiceNow Queue, and so on).    

Note, the 'Response Callback' action can't be used to set attributes for events. 

 

 

Send e-mail:

Parameter Description
recipients recipients of the email. If there are multiple email recipients, addresses can be separated by either a comma ( , ) or semicolon ( ; ).
subject  subject name of the email.
body body of the email, including standard attributes available against events and incidents, e.g. "Source: " + source + "\nSourceName: " + sourceName + "\nSourceCompId-String: "
throttle allows the server to combine emails that are going to the same recipient when they are raised within a defined period. By default, the throttling period is 5 minutes, and can be adjusted via emailThrottlingPeriodSec under the events section in entuity.cfg.

 

Note, the email client used to forward event and incident attributes includes support for secure servers.

 

 

Send SNMP Trap:

Parameter Description
host resolved hostname or IP address of the receiving third-party software.
port trap-receiving port of the receiving third-party software. This is provided as a string (even though it is a number), and therefore must be enclosed within quotes.
version SNMP trap version, i.e. 1, 2, or 3.
community SNMPv1/2c setting. Read community string.
username SNMPv3 setting. Security username.
authProtocol

SNMPv3 setting. There are three levels of authentication, specifying the authentication protocol:

  • null - an empty setting
  • 'MD5' - Message-Digest algorithm 5
  • 'SHA' - Secure Hash Algorithm
authPassword SNMPv3 setting. Authentication password required when authProtocol is set to 'MD5' or 'SHA'. The password must be at least 8 characters long. The parameter value must be enclosed in quotes, so the minimum entered length is 10 characters. 
privProtocol

SNMPv3 setting. There are three levels of authentication, specifying the privacy protocol:

  • null - an empty setting
  • 'DES' - Data Encryption Standard
  • 'AES'
privPassword SNMPv3 setting. Encryption password required when privProtocol is set to 'DES' or 'AES'. The password must be at least 8 characters long. The parameter value must be enclosed in quotes, so the minimum entered length is 10 characters.

 

 

Send to Big Panda:

Parameter Description
app_key the app_key that is configured in BigPanda.
bearer_token the bearer token provided by BigPanda.

 

See this section on Entuity's integration with BigPanda.

 

 

Send to BMC Helix/Helix Queue:

 

Parameter Description
cname connection name.
callback

(Send to Helix Queue only) name of the Response Callback that defines which action to perform upon receiving a response from the BMC Helix server. If no callback is required, you can remove this parameter.

if using callback actions, the way to read the BMC Helix server response:

  • lookupDevice - inventory for a device by the device name or IP address.
  • lookupPort - inventory for a device by port name or IP address and the IfIndex value.
  • lookupResponse - the response value returned, such as from a restAPI call. 
apiKey value of the API Key retrieved from the BMC Helix server.

 

See this section on Entuity's integration with BMC Helix.

 

 

Send to Moogsoft/Moogsoft Queue:

Parameter Description
cname connection name. To connect with Moogsoft using values that are specified in a section other than 'default' in Moogsoft.cfg, you will need to specify the desired value for the cname parameter.
callback

Send to Moogsoft Queue only, name of the Response Callback that defines which action to perform upon receiving a response from Moogsoft. If no callback is required, you can remove this parameter.

if using callback actions, the way to read the Moogsoft response:

  • lookupDevice - inventory for a device by the device name or IP address.
  • lookupPort - inventory for a device by port name or IP address and the IfIndex value.
  • lookupResponse - the response value returned, such as from a restAPI call. 
apiKey value of the API Key retrieved from the Moogsoft server.

 

See this section on Entuity's integration with Moogsoft. 

 

 

 

Send to ServiceNow/ServiceNow Queue:

Parameter Description
cname connection name.
callback

Send to ServiceNow Queue only, name of the Response Callback that defines which action to perform upon receiving a response from ServiceNow. If no callback is required, you can remove this parameter.

if using callback actions, the way to read the ServiceNow response:

  • lookupDevice - inventory for a device by the device name or IP address.
  • lookupPort - inventory for a device by port name or IP address and the IfIndex value.
  • lookupResponse - the response value returned, such as from a restAPI call.
user user account to use for connecting to ServiceNow.
password password of the user account.

 

See this section on Entuity's integration with ServiceNow.

 

 

 

Send to Slack/Slack Queue:

Parameter Description
cname connection name. This relates to the config file needed to send the request.
path webhook path that defines the Slack channel to which events/incidents will be forwarded.
callback

Send to Slack Queue only, name of the Response Callback that defines which action to perform upon receiving a response from Slack. If no callback is required, you can remove this parameter.

if using callback actions, the way to read the Slack response:

  • lookupDevice - inventory for a device by the device name or IP address.
  • lookupPort - inventory for a device by port name or IP address and the IfIndex value.
  • lookupResponse - the response value returned, such as from a restAPI call. 

 

See this section on Entuity's integration with Slack.

 

 

Send to Splunk/Splunk Queue:

Parameter Description
cname connection name. This relates to the config file needed to sent the request.
token the Splunk HttpEventCollector token required to send data to Splunk.
callback

Send to Splunk Queue only, name of the Response Callback that defines which action to perform upon receiving a response from Splunk. If no callback is required, you can remove this parameter.

if using callback actions, the way to read the Splunk response:

  • lookupDevice - inventory for a device by the device name or IP address.
  • lookupPort - inventory for a device by port name or IP address and the IfIndex value.
  • lookupResponse - the response value returned, such as from a restAPI call.

 

See this section on Entuity's integration with Splunk. 

 

 

 

 

 

Was this article helpful?

0 out of 0 found this helpful
Return to top

Related articles

Comments

0 comments

Please sign in to leave a comment.