Alert Response Policies

Alert action policies are crucial for managing alerts effectively. They are used to identify root causes, run remediation scripts, and send notifications. These policies ensure that alerts are appropriately handled, enabling proactive resolution and communication of critical events.

Functionality of Alert Actions Policies

Run Remediation Scripts: Automatically executing predefined scripts in response to specific alerts can resolve issues without manual intervention, reducing downtime and operational costs.
Send Notifications: Ensuring that relevant stakeholders are informed about critical events through various communication channels, enabling timely response and coordination.

Action Components

We have included some actions as part of our out-of-the-box system provider, such as Slack, Teams, and more.

We also support executing StackStorm workflows through our alert response policies. Once a customer has onboarded StackStorm to the VP platform, all action workflows from the onboarded StackStorm instance will be available for execution via alert response policies.

Example:

name: "Test_slack_action_policy"
description: "Sample action policy"
criteria: "event_provider: \"Virtana IO\" AND -status: Closed AND severity: Critical"
category: "alert_response"
precedence: 1
actions:
  - type: "action"
    criteria: "true"
    action_type: "slack"
    action_name: "Slack_Notification"
    parameters:
      webhook_url: "https://hooks.slack.com/services/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"
      message: "Received alert with entity_name - $alert.entity_name , key - $alert.key , summary - $alert.summary and severity - $alert.severity"

How to Create a New Policy

To create a new policy, navigate to Alert Response in Governance and click New Custom Policy.

Note

To generate the policy with Copilot, refer to Alert Intelligence Policies.

Create YAML-Format Configuration:
- Copy Template: Make a copy of the “alert-policy.yaml” template.
- Edit Configuration: Modify the copied file to suit the integration requirements.
- Upload Policy File: Once configured, upload the YAML file containing the policy.

Add General Information:

Policy Name and Description: Enter a descriptive name and detailed description for the policy.

policy: 
           name : "Slack_notification_for_critical_alert"
           description: "Notify critical alert on slack channel"
           precedence: 1
           category: "alert_response"

Add Alert Criteria:
- Filter the type of alerts that occur on the selected resources. If no conditions are defined in this section, all alerts on the selected resources will match this policy.
```
 criteria: "event_provider: OpsCruise AND -status: Closed"
```
Note
The LuceneMemoryIndex class uses a slightly different query syntax than Solr, which affects how we evaluate "Criteria" for each phase/policy. For instance, using the criteria source: EventService AND -entity_type: (pod container) still matches pods and containers. To prevent this, you need to include OR explicitly, like -entity_type: (pod OR container).
Note
We do not support special characters in policy criteria.

Add Actions:

For Alert Response, there is only one policy type, i.e., "action".

Action Type: Slack notification

actions:
      - type: "action"
        action_type: "slack"
        action_name: "Slack_Notification"
        parameters:
          webhook_url: "Add your slack channel url"
          message: "Received alert with entity_name - $alert.entity_name

Email notification

actions:
      - type: "action"
        action_type: "email"
        action_name: "Email_Notification"
        provider_name: "System"
        parameters:
          to_emails: ["example@virtana.com"]
          alert: "$alert"

Mattermost notification

actions:
      - type: "action"
        action_type: "mattermost"
        action_name: "Mattermost_Notification"
        parameters:
          webhook_url: "Add your mattermost url"
          message: "IO: Received alert on entity - $alert.entity_name"

Teams notification

actions:
      - type: "action"
        action_type: "teams"
        action_name: "Teams_Notification"
        parameters:
          webhook_url: "Add your team chat url"
          message: ""

Webex notification

actions:
      - type: "action"
        criteria: "true"
        action_type: "webex"
        action_name: "Webex_Notification"
        provider_name: "System"
        parameters:
          webhook_url: "Add your webex chat url"
          message: ""

HTTP action

actions:
  - type: "action"
    criteria: "true"
    action_type: "http"
    action_name: "Http_Notification"
    provider_name: "System"
    parameters:
          webhook_url: "Add your http url"
          message: ""

Upload Configured YAML File:
- Upload File: Finally, upload the edited YAML file containing the configured policy to implement it.

Navigating the Custom Dashboard

You can explore details of policies, user activities, and leverage visualizations for quick insights. This tabular representation allows the quick assessment of the details of various governance policies in one centralized view. It provides essential information such as the policy's purpose, type, last editor, edit date, and its current state. This enables efficient monitoring, management, and adjustment of governance policies as needed.

Policy Name: The unique name or identifier of the governance policy.
Priority: The priority column in the governance tab indicates the relative importance or urgency of each policy. In this system, a higher number indicates a lower priority, while a lower number signifies a higher priority.
Description: A brief description explaining the purpose or focus of the policy.
Policy Type: The type or category of the policy (e.g., Deduplication, Correlation, Enrichment).
Edited By: The user or team who last edited or modified the policy.
Edit Date: The date and timestamp when the policy was last edited or updated.
State: Indicates the current status of the policy (enable/disable).

Note

All the properties in the alert are accessible as variables with $alert.<property_name>. These names are available under the Properties tab on the Alert details page as raw key-value pairs.

Action Providers

Action Providers	Action
OpsCruise Stackstorm	Actions set by the client.
System	Slack, Teams, WebEx

Creating a policy with Copilot in Alert Response

Virtana's Copilot provides a natural language interface in the Generate Policy With Copilot window, so that you can draft custom alert policies quickly. However, you can review, edit, and enhance the policy before saving it for your environment.

Open the Generate Policy with Copilot window

Perform these steps:

Go to the Global View in the Virtana Platform.
Select Governance, then click Alert Response.
Click New Custom Policy.
The Generate Policy With Copilot window opens.

Tour of the Generate Policy with Copilot window

The window features the Copilot conversational assistant and the policy editor side by side. As you can enter your policy requests in Copilot, you can review and edit the resulting alert policy in YAML format.

Copilot Assistant

Use Copilot as a tool to assist you in creating alert policies.

You can generate these policies by providing natural language descriptions or questions. To see a list of Copilot's features, type 'help' at any time.

The tool allows you to customize your text using the following features:

Features	Description
Natural Language Input	You can describe your policy requirements in plain English, and Copilot generates the corresponding policy logic.
Edit Existing Policies	Load and modify existing policies using natural language or manual edits, or ask Copilot questions about your changes.
Help and Guidance	Enter 'help' in the chat box to access usage tips, sample statements, and guidance.
Action Summaries	Copilot summarizes changes after each update for transparency.
Stop Function	Enter Stop in the chat box to interrupt Copilot’s processing and revert to the previous state if needed.
Feedback	Use the thumbs up/down icon to provide feedback and improve Copilot’s accuracy.

Here are a few sample prompts:

Send an email notification when a critical severity alert is received from an external source.
Post a Slack message when an alert with severity Major or Critical is opened for entity type host.

Policy Editor

This section displays the YAML structure where the generated alert policy appears. You can manually edit the policy fields, including:

Field	Description
Name	Enter a unique and descriptive name that reflects the purpose of the policy.
Description	Provide a detailed explanation of what the policy aims to achieve and its significance.
Criteria	Define the triggering conditions under which the policy will be applied, typically filtering alerts based on their status.
Precedence	Set a value indicating the priority of the policy, with lower numbers representing higher priority.
Category	Classify the policy under the correct category, which in this case will be set to "alert_handling".

Actions

Use Actions to manage your policy files. Actions for creating and editing your policies are available in the top-right corner of the window.

Action	Description
Upload File	Import policy files for reuse, backup, or sharing in `.yaml` format.
Save Policy	Save the current policy you’ve written or modified.
Cancel	Exit the policy creation screen without saving changes.

Create a policy using Copilot

To create a policy using the provided Copilot, perform the following steps:

Click New Custom Policy to open the Copilot interface.
Enter a natural language prompt describing what you want the policy to do, for example, suppress alerts from server group X during maintenance windows.
Copilot generates the policy.
Alternately, you can click Upload File to import an existing policy in .yaml format.
Review the output, make manual edits if needed, or ask follow-up questions to the Copilot.
(Optional) If you need to interrupt Copilot’s processing, enter 'Stop' to cancel and revert.
Click Save Policy to save the policy.
You can view the policy on the Alert Response page. Check and enable the policy using the toggle button under the status column to activate the policy.

Edit a policy using Copilot

To edit a policy using the provided Copilot, perform the following steps:

In the Alert Response page, click the existing policy name.
The Alert Policy window opens.
You can view the general information about the policy and the policy code.
Use the toggle button to enable the policy execution state.
Click Edit to edit the existing policy.
The Update Policy window opens.
Review the policy, make manual edits if needed, or ask follow-up questions to the Copilot.
(Optional) If you need to interrupt Copilot’s processing, enter 'Stop' to cancel and revert.
Click Update to save the updated policy.
You can view the policy on the Alert Response page. Check and enable the policy using the toggle button under the status column to activate the policy.

Caution

While Copilot provides a starting point for creating policies, some of Copilot's answers may be incorrect, incomplete, or misleading for your organization. Be sure to validate the resulting policy in the provided editor.

Testing the generated policies

You can safely test your alert response policies before saving them, using the built-in sandbox feature. This lets you preview your policy's behavior on real or synthetic alerts without impacting production alerts or triggering real actions. It provides a controlled environment to verify that your policies behave exactly as intended.

Perform the following steps:

Create a new policy or edit an existing one in the policy editor.
When Copilot opens, it will ask you if you want to validate your policy before saving.
Click the green Test this policy on existing alerts button to validate your policy against open alerts in your environment.
This lets you validate your policy against real, open alerts in your environment.
To test your policy against the alert, you can upload an alert JSON file from a local folder or select an alert from the alert list.
After selecting or uploading an alert, click the Test button.
The sandbox will evaluate your policy against the chosen alert and show you the Policy execution summary.
Review the policy execution summary and adjust your policy in the editor until the test results show the behavior you want.
Once verified, click Save Policy.

In this section:

Alert Response Policies

Functionality of Alert Actions Policies

Action Components

How to Create a New Policy

Note

Note

Note

Navigating the Custom Dashboard

Note

Action Providers

Creating a policy with Copilot in Alert Response

Open the Generate Policy with Copilot window

Tour of the Generate Policy with Copilot window

Copilot Assistant

Policy Editor

Actions

Create a policy using Copilot

Edit a policy using Copilot

Caution

Testing the generated policies

Search results