How do I configure the Entuity integration with Moogsoft?

To configure the Entuity integration with Moogsoft

How Entuity incidents are mapped to Moogsoft

Entuity incidents can be pushed from Entuity to Moogsoft AIOps using the Moogsoft RESTful services.

To configure the Entuity integration with Moogsoft:

1. In Moogsoft:
   1. Navigate to Integrations > Install UI.
   2. Create a default Webhook LAM and set a name for the integration. 
      This establishes the Moogsoft endpoint for Entuity to connect with, together with the user and password for the Moogsoft client that uses basic authentication. You do not need to make changes to the other editable dialogs.
       
2. In Entuity:
   1. Navigate to the enutity_home/etc directory.
   2. Use the Moofsoft-example.cfg file in this directory to create a file called Moogsoft.cfg.

   3. Update the 'default' section or add a named 'section' to the file that lists key-value pairs for port, host, path, user and password.
      These values are available in the Integrations > Install UI for the Moogsoft Webhook LAM you created in step 1:

      [default]
      port-443
      host=endpoint.moogsoft.io
      path=/events/webhook_ena
      user=Webhook
      pass=password

      
      Note, user and pass attributes are not required if using the 'Send to Moogsoft Queue' action, as they can be entered as parameters in the action itself.
      
      Note, if the configuration file that specifies these connection properties is not named  Moogsoft.cfg and/or is not located in the entuity_home/etc directory, then you must define the actual location of the file in the eventEngine section of the Entuity startup_XX.cfg configuration file.. You can do this by specifying the JVM property, property, 'moog.cfg', within the eventEngine start command:

      -Dmoog.cfg=${ENTUITY_HOME}${FPS}etc${FPS}YourMoogsoftConfig.cfg

3. In the Entuity UI, set up the Entuity incident trigger to forward Entuity incidents to Moogsoft:
   1. Click Main Menu and then Administration.
   2. On the Administration page, click Event Administration.
   3. On the Event Administration page, click the Incidents tab.
   4. Click Edit Global Triggers at the bottom of the window to open the Edit Global Triggers window.
   5. Click Add to open the Create Trigger window.
   6. Complete the Name and Description fields, as appropriate, and ensure that the enabled checkbox is selected.
   7. In the Action Steps section, click Add to open the Add Action window.
   8. In the Type dropdown field, select 'Send to Moogsoft' or, from Entuity v23 P01 upwards, the 'Send to Moogsoft Queue' action step to forward incidents.
      As of Entuity v23.0 P01 upwards, the 'Send to Moogsoft' action forwards incidents directly to Moogsoft, while the 'Send to Moogsoft Queue' action forwards incidents to Moogsoft through a queue from the Message Broker. Sending through a queue helps prevent communication or connection errors during the forwarding process, as messages remain in the queue until successfully acknowledged by the target endpoint. A message queue log file is also created when using the 'Send to Moogsoft Queue' action. For more information on message queues, see this article.
      
   9. For Entuity to connect with Moogsoft using values specified in a section other than the [default] section in the Moogsoft.cfg file from step iii, set the action step cname parameter value to the section name in the Moogsoft.cfg file, without [] brackets.
      
      
   10. If you selected selected the 'Send to Moogsoft Queue' action step (Entuity v23.0 P01 upwards), choose whether to execute callback actions by optionally using the 'Response Callback' action. Do one of the following.
       • If you want a 'Response Callback' action executed when incidents are sent to Moogsoft:
         1. Keep the callback = 'Response Callback' parameter in the 'Send to Moogsoft Queue' action step.
         2. Create a Moogsoft-specific 'Response Callback' action from the Actions tab of the Event Administration page, and define which action to execute upon receiving a response from Moogsoft.
         3. Return to the 'Send to Moogsoft Queue' action step from the Incidents tab of the Event Administration page, and enter the name of the newly created 'Response Callback' action in the callback = 'Response Callback' parameter.
       • If no 'Response Callback' action is required, set the value to null without quotes.
         
         
         
   11. Click OK, and then click OK again on the Edit Global Triggers window.
        

4. In a multi-server configuration of Entuity, confirm that some information about the consolidation server is available in the main section of the Entuity entuity.cfg file on all servers. 
   This is required, as the data is included in the payload that is sent to Moogsoft for reverse communication:

   consolidation_server_name=server-name
   consolidation_server_web_port=X
   consolidation_server_web_ssl=true or false

5. In Moogsoft:

   1. Set up the data to be used for Moogsoft deduplication by navigating to Integrations > Alert Noise Reduction in the UI.
   2. Edit the Signature Editor by removing the existing default entries and replacing them with the word 'signature' (without quotation marks). 
      The value of the signature field in the payload that is sent to Moogsoft will be used for their deduplication analysis.

   
   Note, this setting will be required until the proprietary Entuity LAM is available, at which point it will already be set as the default signature field.

How Entuity incidents are mapped to Moogsoft: 

The below tables describe how Entuity incidents are mapped to Moogsoft JSON fields: