Example of an Action in Dexda
Last updated on 06 August, 2024The following is a walk-through of the steps and actions in the preconfigured LM Alert Processing Action.
| Sequence | Description |
| Create a new alert | If the event severity is > 0, and there is no existing open alert, a new alert is created (outcome alert cleared). |
| Update existing alert | If the outcome of the previous step is alert exists, and the alert is not closed, then the existing alert is updated. |
| Find a LM-DX reference for this alert | If the outcome of the previous step was an update alert, then find the reference to the ServiceNow ticket. |
| Update ServiceNow incident linked to this alert | If the outcome of the previous step was rowkey found, then update the ServiceNow incident. |
| Update alert | Sets the value of the incident ID to pending The process requested an incident creation in ServiceNow, and eventually, a ServiceNow record will be returned. |
| Update associated insight | Maintain the severities, last event timestamp, and state of any associated Insight |
| Find a LM-DX reference for this insight | Find any ServiceNow LM-DX reference for this Insight |
| Update ServiceNow incident linked to this insight | Update any existing Incident for which we found a row key |
| Update insight | Update the insight based on SNC incident update |
| Create ServiceNow incident for this insight | Creates a new ServiceNow incident when the previous action does not have an existing insight record |
| Store rowkey | Store a mapping between the insight and the ServiceNow LM-DX reference |
| Update insight | Update the insight based on the SNC incident update |
| Wait for correlation | Wait at least 15 mins to allow this new alert to correlate |
| Create ServiceNow incident for this alert | If the alert is not yet correlated (Escalation equals correlated), then directly create an incident for this alert. Do not create an incident if the alert has only reached indeterminate (maintenance). |
| Store rowkey | The flow for a new alert. The rowkey was looked up in ServiceNow in a previous step, and here it is returned. It is stored only if the outcome was that an incident was created. The external record type is sncIncident, and the internal record type is alerts. |
| Update alert | Update the alert state to indicate that an Incident has been requested |
| Wait for 7 days | Wait time for uncorrelated alerts to be investigated |
| Auto-close alert if created more than 7 days | Sets the alert escalation to closed, and the alert disappears from the list of Uncorrelated Alerts on the dashboard. This only happens if the alerts haven’t been touched during the 7 days. Note that any associated ServiceNow incident record is still available, and you can access the alert details in Dexda from the link in ServiceNow. |