Managing First Response PolicyDescribes how to create and manage first response policies.Leave FeedbackIntroductionFirst response policy allows you to auto-suppress alerts as a first response mechanism for frequent and unnecessary alerts.PrerequisitesYou must have OpsQ View and OpsQ Manage permissions to access First Response Policy.NoteA training file is required to suppress specific alerts or to snooze specific alerts. The training file must include examples of alerts that need to be suppressed. See Alert Managament Training File for more information.Creating first response policiesCreation of a first response policy includes the following steps:Enter name and policy modeFilter criteriaPolicy definitionPrerequisiteBoth OpsQ View and OpsQ Manage permissions are required to access the Alert Escalation Policy.Step 1: Enter policy name and modeTo enter the policy name and select mode:Click All Clients and select a client.Go to Setup > Alerts > First Response.Click +Add.Provide a name for the policy.From the Mode drop-down, select the required mode.Enter policy name and modeStep 2: Filter criteriaTo filter for resources whose alerts match this policy:Select Filter Criteria.Choose from Any or All of the defined conditions to apply a filter for the alerts.Select Native Attributes or Custom Attributes depending on your requirement.Note: Native Attributes are the predefined attributes and Custom Attributes are user-defined attributes.Select the required attribute, logical operator, and provide the value.Note: Click + to add multiple filter conditions.Filter criteriaStep 3: Policy DefinitionAlert Pattern ActionsTo train the system to suppress alerts that have a common pattern:Select Suppress alerts that happen regularly, at around the same time to suppress alerts that happen regularly at around the same time.Click Save.Alert Pattern ActionAlert Attribute ActionsManually assign first-response actions or train the system to apply the selected first-response actions on the alerts containing specific characteristics.Suppress Alerts: To manually suppress alerts, from the Suppress Alerts drop-down, select the required suppress action and click Save.Run Processes: To manually add a process definition, from the Run Processes section, click Add, select the required process definition and click Save.Alert Attribute ActionsNoteYou can select Learned Configuration to train the system to run first-response actions on the alerts. This option applies to both Suppress Alerts and Run Processes options.Selecting Learned ConfigurationTo apply the first-response actions using a training file or machine-learning:Select Learned Configuration.To add a training file:Click Drop the training data file here, or browse to upload a training file.Note: One client can upload only one training file. Changing the training file affects all the learned policies of the client.Select the file from your local folder.On uploading the file Input and Output columns appear.Verify the Input and Output columns.Verify Input and Output ColumnsClick Continue to Model Training.Click Train Model.The accuracy of the trained first-response policy appears in the Summary section.Click Review and then click Save.Review the model accuracy.(Optional) Click Edit to modify the configuration if required.To apply first-response actions using machine-learning, ensure Continuous Learning is enabled by default to suppress alerts using historical data. However, if you do not rely on machine-learning suppression, disable the toggle button.The first response policy is created and appears on the First Response Policies page.Created First Response PoliciesEditing policiesTo modify the details of existing first response policy:Click on the policy name.From the policy page, click Edit.From EDIT FIRST RESPONSE POLICY, edit the details as required.Click Save.Deleting policiesTo delete a policy that is no longer used:Select the check box adjacent to the policy and then click Delete.Click Yes on the confirmation window. The policy is deleted from the First Response Policies List.Creating copiesTo create a new policy using the details of an existing policy:From the First Response Policies page, select the check box adjacent to the policy and click the copy icon. The NEW FIRST RESPONSE POLICY page is displayed with the main policy details.Provide a unique name for the policy.Modify the details as required.Click Save.The new policy is created and displayed under First Response Policies List section.