Alert Enrichment V2

Enrichment is the process of adding contextual information to alerts in BigPanda. Use the Enrichments API to define alert tags and enrichment maps that help users understand incidents more quickly and enrich BigPanda functionality, including correlation patterns and maintenance plans.

The Enrichments API allows you to programmatically create custom enrichment maps that add contextual information to alerts.

Define an enrichment schema using these API resources:

  • Alert Enrichments object, which defines the enrichment technique and configuration details associated with that technique. For example, in a mapping enrichment, the configuration details include a description of the data mapping table.
  • Sub-objects that are specific to the enrichment technique. For mapping enrichment, the Map endpoint allows you to upload and maintain a data mapping table.

The API works by evaluating all incoming alerts to see if they match an active enrichment definition. Matching alerts are enriched with the defined alert tags according to the instructions in the enrichment definition.

Relevant Permissions

Roles with the following permissions can access the Enrichments API:

PermissionDescription
Enrichments_Read
Enrichments_jobs_Read
Read only - view the Enrichments API.
Enrichments_Full_Access
Enrichments_jobs_Full_Access
Full access - use the Enrichments API to view and define mapping enrichments.

To learn more about how BigPanda's permissions work, see the Roles Management guide.

Use Cases

Use the Enrichment API to develop a common language between monitoring systems and to identify upstream and downstream dependencies between configuration items.

Cross-Source Relationships

Define common tags to identify when alerts from different monitoring sources are related to the same monitored object in your infrastructure. For example, you can define a mapping enrichment for cluster based on the Pingdom service. Then, define an extraction enrichment for cluster based on the Nagios host name. Now, a cross-source correlation pattern on the cluster tag can group related alerts from either system into the same incident.

Topology Metadata

Understand the physical and logical relationships between alerting objects and the rest of your infrastructure. For example, you can leverage a CMDB to identify when different objects have the same parent object (such as multiple hosts in the same cluster). Then, define correlation patterns for objects with the same parent, Environments that reflect your infrastructure, and/or maintenance plans that suppress alerts for objects downstream of an object under maintenance.

Operational Metadata

Help IT Operations teams categorize, prioritize, route, and remediate an incident. For example, you can leverage a team spreadsheet to add assignments, categories, and priorities to alerts. Then, define Environments, dashboards, and Analytics reports to ensure the right teams have visibility into issues and/or define AutoShare rules to automatically trigger escalation processes.

JSON Format

The Alert Enrichment API accepts only standard double quoted JSON formatting. Python JSON uses single quotes and will not be accepted by the API.

If using Python, please sanitize your JSON to adhere to standard double quoted JSON formatting. See the sample payload below as an example of an acceptable JSON format.

Example JSON formatted payload:

curl --request POST \
  --url https://api.bigpanda.io/resources/v2.0/alert-enrichments \
  --header "Authorization: Bearer ${your_api_key}" \
  --header 'Content-Type: application/json' \
  --data '{
    "type": "mapping",
    "active": true,
    "when": "discard != true",
    "config": {
        "name": "map-test5",
        "fields": [
            {
                "title": "application",
                "type": "query_tag"
            },
            {
                "title": "application1",
                "type": "query_tag"
            },
            {
                "title": "owner",
                "type": "result_tag",
                "override_existing": false
            },
            {
                "title": "Runbook URL",
                "type": "result_tag",
                "tag_name": "wiki",
                "override_existing": false
            }
        ]
    },
    "note": "wiki.com"
}'

Available Objects and Actions

ObjectDescriptionSupported MethodsAPI Endpoint
Alert Enrichments ObjectDefines the schema for an enrichment.POST, GET, PATCH,PUT,<https://api.bigpanda.io/resources/v2.0/enrichments-config>

Use the Enrichments API to perform these actions.

ActionDefinitionDescription
Create Alert Enrichment ItemPOST /alert-enrichments/Creates a new definition for an enrichment schema.
Update Alert Enrichment ItemPATCH /alert-enrichments/{id}Activates or deactivates a specific enrichment definition.
Delete Alert Enrichment ItemDELETE /alert-enrichments/{id}Deletes an existing enrichment item.
Retrieve Alert Enrichment ItemGET /enrichments-config/tags/{RuleID'}Retrieves a specific enrichment item.
List all Enrichment items of a TagGET /enrichments-config/tags/{TagName'}Retrieves all the enrichment items for a tag.
List all Alert TagsGET /enrichments-config/tagsLists all alert tags that exist for an organization.
Retrieve Tags orderGET /enrichments-configRetrieves the tags order (execution plan).
Update Tags orderPUT /enrichments-configUpdates the tags order (execution plan).
Retrieve Enrichment item's order of a TagGET /enrichments-config/tags/{TagName}/orderRetrieves the enrichment items order for a tag.
Update Enrichment item's order of a TagPUT /enrichments-config/tags/{TagName}/orderUpdates the enrichment items order for a tag.
Create Mapping Enrichment TablePOST /alert-enrichments/
(type=mapping)
Creates and Defines a new enrichment mapping table that.
Update Mapping Enrichment definitionsPATCH /alert-enrichments/{Map_id}Activates or deactivates a specific enrichment definition.
Create Mapping Enrichment Table Rows POST /alert-enrichments/{map_id}/mapCreates specific rows of an existing mapping enrichment table.
Update Mapping Enrichment Table RowsPATCH /alert-enrichments/{map_id}/mapUpdates specific rows of an existing mapping enrichment table.
Retrieve Mapping EnrichmentGET /alert-enrichments/{map_id}/mapRetrieves a specific enrichment map.
Check Status of Upload JobGET /alert-enrichments-jobs/{job_id}Checks the status of an asynchronous job to upload or update a mapping enrichment table.

🚧

Rate Limitations

To maintain quality of service, the Alert Enrichment API is limited to 5 requests per second.
Additional requests will return a 429 response code and the request will need to be retried.