Skip to main content
Version: 3.2.0

Event Automation

This chapter explains how the AME Event automation works for Rules and Notifications.

The following image shows how AME turns Splunk alerts into events. Events can trigger rules and notifications.

Automation Flow

  1. An Alert gets triggered and creates or updates an Event
  2. The event triggers the rule engine. If a rule is found and all conditions are fulfilled the event gets updated
  3. (Optional) If a keyword is defined, the keyword is also written into the Notification Queue.
  4. The event is updated, and a copy of the event data is written into the Notification Queue.
  5. The Notification Engine tracks the notification queue
  6. If a matching flow is found, the Notification Queue is updated with information about targets (channels) to be notified
  7. A worker process is sending Notifications to the specified targets.

Rule Engine Field Reference

Besides event data fields, the Rule Engine has following event metadata available to use for conditions:

Field NameDescriptionTypeExample
ame.assigneeThe current assignee of the an eventStringadmin
ame.countThe duplicate countInteger1
ame.event_titleThe event titleStringAlert for host xyz
ame.event_ttlThe event TTLInteger600
ame.first_seenThe first seen timestampInteger1711401172
ame.impactEvent impactStringlow
ame.most_recentThe most recent timestampInteger1711401172
ame.notificationsThe notification UIDString63d76e6be87c1840f142114
ame.notable_fieldsThe notable fieldsStringlistsrc_ip,dest_ip,count
ame.priorityEvent priority valueInteger1
ame.priority_nameThe priority nameStringlow
ame.resolutionThe resolution UIDString63d76e6be87c1840f142114
ame.resolution_nameThe resolutionStringTrue positive
ame.search_nameThe name of the saved searchStringmyalert
ame.statusThe status UID of the eventString63d76e6be87c1840f142114
ame.status_nameThe status nameStringin_progress
ame.tenant_uidThe name of the tenantStringdefault
ame.templateThe template UIDString63d76e6be87c1840f142114
ame.template_nameThe template nameStringdefault
ame.ttl_targetThe next status for the eventStringresolved
ame.urgencyEvent urgencyStringlow

Notification Engine Field Reference

Besides event data fields, the Notification Engine has the following event metadata available to use for conditions:

Field NameDescriptionTypeExample
ame.assigneeThe current assignee of the an eventStringadmin
ame.countThe duplicate countInteger1
ame.event_titleThe event titleStringAlert for host xyz
ame.event_ttlThe event TTLInteger600
ame.first_seenThe first seen timestampInteger1711401172
ame.impactEvent impactStringlow
ame.most_recentThe most recent timestampInteger1711401172
ame.notificationsThe notification UIDString63d76e6be87c1840f142114
ame.notable_fieldsThe notable fieldsStringlistsrc_ip,dest_ip,count
ame.priorityEvent priority valueInteger1
ame.priority_nameThe priority nameStringlow
ame.resolutionThe resolution UIDString63d76e6be87c1840f142114
ame.resolution_nameThe resolutionStringTrue positive
ame.search_nameThe name of the saved searchStringmyalert
ame.statusThe status UID of the eventString63d76e6be87c1840f142114
ame.status_nameThe status nameStringin_progress
ame.tenant_uidThe name of the tenantStringdefault
ame.templateThe template UIDString63d76e6be87c1840f142114
ame.template_nameThe template nameStringdefault
ame.ttl_targetThe next status for the eventStringresolved
ame.urgencyEvent urgencyStringlow

Additionally, trigger condition fields are available:

Field NameDescriptionTypeExample
changedThe field that has changedStringlistame.status_name,ame.assignee
valuesThe value of the field that has changedStringlistnew,admin
keywordA keyword that is passed from a ruleStringlistmykeyword