Skip to main content
Version: 5.3

Setting Up Grouping Rules

General Description​

One of the tools that allows optimizing the process of responding to incidents and their analysis is incident grouping.

The essence of grouping lies in combining similar incidents that possess identical characteristics into a single group. This allows transitioning from a scattered list of individual events to a more structured representation, identifying patterns, and simplifying situation analysis.

To implement such behavior, it is necessary to set up grouping rules. The rules determine which specific fields of the incident will be used for comparison and subsequent grouping.

Creating Grouping Rules​

To access the rules by which incidents will be grouped, go to Main Menu - Incident Manager section - Grouping Rules Setup.

Rules list

At the top of the interface, there is a search bar and filters for convenient rule management, as well as a button for creating new rules.

To create a grouping rule:

  1. Click the Create button at the top of the interface
  2. Fill in the fields in the editor
  3. Click the Save button at the top or bottom of the interface

Rule Editor​

The editor consists of 4 sections: Basic, Comparison Fields, Functional Fields, and Additional Fields.

Rule editor

Basic​

In the Basic section, the main grouping parameters are filled in:

  • Name - the name of the rule that will be displayed in the list of rules
  • Display Name - the name of the incident group in the Incident Manager
  • Description - description of the incident group

general

The fields Displayed Name and Description support tokenization. Tokens are available that contain information about the grouping result:

  • comparison_fields - indicates which field from the Comparison Fields section was used for grouping
  • function_fields - displays the results of function calculations applied to fields from the Functional Fields section
  • aggregation_info - stores information about the grouping settings, including the name of the current configuration
  • incidents_count - shows the total number of incidents combined into this group

Besides this, the General section includes the following parameter settings:

  • Workflow - the workflow that will be used for the group
  • Closure Statuses - statuses that will be used to close the group
  • Criticality - the importance level of the incident group
  • Search Tasks - search jobs that will be used for grouping (SP tasks are marked with the SP-job tag)
  • Lifetime - the lifetime of the incident group
  • Maximum Time Between Incidents - the maximum time between incidents for grouping
  • Synchronize with new incidents - switch

Settings General

Detail Type

Mechanism for setting initial conditions for an analytical report, which serves as an entry point for subsequent (drilldown) operations.

The Specify time boundaries for drilldown switch is a specialized configuration parameter for Search that determines how the time filter will be applied when performing (drilldown) operations.

Detail Type Search

Comparison Fields​

In the Comparison Fields section, you can set comparison parameters for grouping:

Comparison Fields

  • Field Name - the final name of the field to be displayed in the aggregation
  • Search Task - the search job that generates the incident
  • Value - the name of the field from the incident to be compared. If in the field Search jobs if more than one task is selected, then the name of the field from the incident must be specified for each task. If you need to compare by the field that was included in the incident from the search results in the search job, then add the prefix fields: fields before the field.<Field name>. There is no need to add a prefix for the fields from the incident card

Functional Fields​

In the Functional Fields section, you can configure calculations in the group.

Functional Fields

  • Field Name - the final name of the field to be displayed in the aggregation
  • Function - the function that will be applied to the field from the incident The following functions are currently supported:
    • MAX, MIN, SUM, VALUES, AVG, EARLIEST, LATEST
  • Search Task - the search job that generates the incident
  • Value - the name of the field from the incident to be compared. If in the field Search jobs if more than one task is selected, then the name of the field from the incident must be specified for each task. If you need to compare by the field that was included in the incident from the search results in the search job, then add the prefix fields: fields before the field.<Field name>. There is no need to add a prefix for the fields from the incident card

Using fields from this section is convenient, for example, when you need to specify in the group card which hosts were mentioned in all incidents of the group.

Additional Fields​

In the Additional Fields section, you can set additional incident parameters that are changed in the module settings.

Additional Fields

Editing Grouping Rules​

To edit a grouping rule:

  1. In the Grouping Rules table, in the Actions column, click the ... button
  2. Select the Edit action
  3. Make changes in the Rule Editor
  4. Click the Save button at the top or bottom of the interface

Edit

Enabling and Disabling Grouping Rules​

To enable and disable grouping rules:

  1. In the Grouping Rules table, in the Actions column, click the ... button
  2. Select the Disable or Enable action

Deleting Grouping Rules​

To delete a grouping rule:

  1. In the Grouping Rules table, in the Actions column, click the ... button
  2. Select the Delete action

Bulk Operations on Groups​

Editing and Deleting Groups​

When configuring incident groups, the functionality for bulk editing and deleting groups is also implemented. To do this, you need to:

  1. In the Incident Groups table, select the required groups by clicking on the empty squares to the left of the group name
  2. Choose the action Edit selected or Delete aggregations
  3. If editing is being performed, select the configuration type: Permissions or Tags

As a result, the selected action will be applied to all chosen groups.

Exporting Incident Groups​

To work with selected incident groups, a data export function is available. To do this:

  1. Select groups in the Incident Groups table. To do this, check the boxes in the corresponding rows (in the column to the left of the group name)
  2. Click the Export button, which will appear on the top toolbar after selecting one or more groups
  3. In the dialog box that opens, confirm the action by clicking Export
info

Export is only available when items are selected. Data is exported to a file in .json format.