Introduction

First response policy allows you to auto-suppress alerts as a first response mechanism for frequent and unnecessary alerts.

Prerequisites

You must have OpsQ View and OpsQ Manage permissions to access First Response Policy.

Creating first response policies

Creation of a first response policy includes the following steps:

  1. Enter name and policy mode
  2. Filter criteria
  3. Policy definition

Prerequisite

Both OpsQ View and OpsQ Manage permissions are required to access the Alert Escalation Policy.

Step 1: Enter policy name and mode

To enter the policy name and select mode:

  1. Click All Clients and select a client.
  2. Go to Setup > Alerts > First Response.
  3. Click +Add.
  4. Provide a name for the policy.
  5. From the Mode drop-down, select the required mode.
Enter policy name and mode

Enter policy name and mode

Step 2: Filter criteria

To filter for resources whose alerts match this policy:

  1. Select Filter Criteria.
  2. Choose from Any or All of the defined conditions to apply a filter for the alerts.
  3. Select Native Attributes or Custom Attributes depending on your requirement.
    Note: Native Attributes are the predefined attributes and Custom Attributes are user-defined attributes.
  4. Select the required attribute, logical operator, and provide the value.
    Note: Click + to add multiple filter conditions.
Filter criteria

Filter criteria

Step 3: Policy Definition

Alert Pattern Actions

To train the system to suppress alerts that have a common pattern:

  1. Select Suppress alerts that happen regularly, at around the same time to suppress alerts that happen regularly at around the same time.
  2. Click Save.
Alert Pattern Action

Alert Pattern Action

Alert Attribute Actions

Manually assign first-response actions or train the system to apply the selected first-response actions on the alerts containing specific characteristics.

  • Suppress Alerts: To manually suppress alerts, from the Suppress Alerts drop-down, select the required suppress action and click Save.
  • Run Processes: To manually add a process definition, from the Run Processes section, click Add, select the required process definition and click Save.
Alert Attribute Actions

Alert Attribute Actions

Selecting Learned Configuration

To apply the first-response actions using a training file or machine-learning:

  1. Select Learned Configuration.
  2. To add a training file:
    1. Click Drop the training data file here, or browse to upload a training file.
      Note: One client can upload only one training file. Changing the training file affects all the learned policies of the client.
    2. Select the file from your local folder.
      On uploading the file Input and Output columns appear.
    3. Verify the Input and Output columns.
      Verify Input and Output Columns

      Verify Input and Output Columns

    4. Click Continue to Model Training.
    5. Click Train Model.
      The accuracy of the trained first-response policy appears in the Summary section.
    6. Click Review and then click Save.
    7. Review the model accuracy.
    8. (Optional) Click Edit to modify the configuration if required.
  3. To apply first-response actions using machine-learning, ensure Continuous Learning is enabled by default to suppress alerts using historical data. However, if you do not rely on machine-learning suppression, disable the toggle button.

The first response policy is created and appears on the First Response Policies page.
Note: Click the count of numbers displayed against Number of suppressions to view details.

Created First Response Policies

Created First Response Policies

Editing policies

To modify the details of existing first response policy:

  1. Click on the policy name.
  2. From the policy page, click Edit.
  3. From EDIT FIRST RESPONSE POLICY, edit the details as required.
  4. Click Save.

Deleting policies

To delete a policy that is no longer used:

  1. Select the check box adjacent to the policy and then click Delete.
  2. Click Yes on the confirmation window. The policy is deleted from the First Response Policies List.

Creating copies

To create a new policy using the details of an existing policy:

  1. From the First Response Policies page, select the check box adjacent to the policy and click the copy icon. The NEW FIRST RESPONSE POLICY page is displayed with the main policy details.
  2. Provide a unique name for the policy.
  3. Modify the details as required.
  4. Click Save.
    The new policy is created and displayed under First Response Policies List section.