Skip to main content
Version: 6.2

Active Actions

Overview​

Active actions let you respond to events and incidents both inside Smart Monitor and in external systems: lock an account in Active Directory, block an IP address on a firewall, create an incident or send an email to the on-duty engineer.

The same action can be run in different places: on the results of a Job Scheduler search job, manually from an incident card, automatically when the incident status changes in a Workflow, or when an SLA policy threshold is reached. The response logic is written once and then reused wherever it is needed.

Actions are divided into system and user actions. System actions are built into the Job Scheduler module and cannot be edited. A user active action is based on a script.

Attention!

Incident Manager active actions (Incident Manager - Active Actions) are deprecated and will be removed in future versions. Migrate such actions to script-based active actions.

Structure of a User Active Action​

The configuration is split into three levels.

LevelWhat it defines
Script configurationWhat to run: the code that does the work, its input and returned parameters
Active action configurationHow it looks and where it is used: the title, which parameters the user sees and changes, where the action is available
Application in modulesHow to run it: rules for filling the action input parameters in modules — where to take the data from

Script​

A script is an executable Python file. The script declares a contract: the list of input parameters it accepts and the list of returned parameters it returns on completion.

The script does not know who called it and from where: an analyst from an incident card or a scheduled search job. It receives the input parameter values and returns the result.

Active Action​

An active action is an application of a script. The action defines three things:

  • how the operation is named and described for the user
  • which input parameters are shown to the user, which of them can be changed, and which are set by the administrator and hidden
  • in which modules the action is offered for running

You can create several actions with different settings on the same script. For example, an account lock script can underlie two actions:

  • Lock AD account — for manual launch from an incident: the analyst specifies the reason and the lock period, the domain and the ticket priority are set by the administrator
  • Auto-lock by policy — for Job Scheduler: all parameters are set in advance

Application Point​

An application point is the module where the action is run. For each point, the administrator configures once where the value of each input parameter comes from:

  • Job Scheduler — the action runs on the results of a search job, values are taken from the search result fields
  • Incident type — the analyst runs the action manually from an incident, values are taken from the incident fields or entered at launch
  • Workflow transition — the action runs automatically when the incident status changes, values are taken from the incident fields and from the results of previous transition actions
  • SLA policy — the action runs automatically when an SLA time threshold is reached
Screenshot

actions-overview-scheme.png — diagram of the level relationships: one script, two active actions on it and the application points of each action (Job Scheduler, incident type, workflow transition).

Configuration Order​

To start using an active action, configure it in the following order:

  1. Create a script: describe the input and returned parameters and write the code
  2. Create an active action based on the script: set the title, configure the fields and select the scopes
  3. Add the action to an application point and specify the data source for each input parameter

If a suitable built-in action already exists, skip the first step.

tip

Changes in the active action card apply everywhere the action is used. To make a variant of the action with different settings for a separate case, create another action on the same script.