AlertOps and SMAX

Service Management Automation X (SMAX) is a service management solution driven by analytics, that combines four key application areas: IT Service Management (ITSM), IT Asset Management (ITAM), Extended Service Management (XSM), and Cloud Management and has fully-functioning out-of-the-box processes and workflows.

AlertOps’ alert management system can be integrated with SMAX to receive and respond to all (predefined status mappings) alerts through email, SMS, push notification or phone alerts. AlertOps would ensure that the incident status would reach the appropriate team by using proper workflows, escalation policies and schedules. Based on your ruleset, incidents can be automatically opened and closed, depending on how a SMAX incident is updated. 

(https://marketplace.microfocus.com/itom/content/alertops-smax-integrations)

The above scenario and scope for integration is due to the fact that AlertOps has a very flexible and simple API/Webhook configuration feature that can be leveraged with SMAX's integration capabilities. With SMAX's API, a two-way integration can also be done. 

AlertOps - Inbound Integration

We can define some rulesets in AlertOps so that SMAX can send out incident alerts to the AlertOps platform. AlertOps would ensure based on these notifications received, that it would always reach out and assign to the correct person/team by utilizing its escalation policies, schedules, and workflow features.

AlertOps provides Inbound Integrations to integrate with numerous monitoring, chat and ITSM tools. You can configure an inbound integration for SMAX incidents.

At a high level this is how the flow looks like, you define an API integration in the AlertOps platform by defining settings like Integration Name, Escalation rules, recipient users/groups. Once an integration is defined, a unique API URL is generated. This acts as webhook or the gateway through which notifications from SMAX reach AlertOps and thus an incident/alert is created correspondingly. The API can be defined with various settings like URL mappings, filters, escalations etc. as required. 

SMAX has to be configured with an On-premise bridge Agent, Endpoints, Credentials, Studio Process rule.

Configure Inbound Integration in AlertOps

1. Under 'Integrations' select 'Inbound Integrations', select the category 'API' and then select add 'Add API Integration'
2. There are numerous integration options available in AlertOps, select SMAX Micro Focus
3. Once you select the integration, you can then specify basic settings like the integration name, escalation policy, names of the recipients/groups for which the alerts must be assigned to.
4. Once you click save, the API Integration will be created, and you will be given a unique URL which acts as the access point and needs to be configured at the source (in this case SMAX), to send alerts. You can find the integration you just created, and you can give advanced settings and define various configurations for the alerts to be received and processed. For example, you can define when to open and close alerts based on the payload obtained from the API call, filters etc.
5. Make a note of the API URL, which will be used in SMAX, so it calls a HTTP POST request to this URL with the body in JSON format containing the icnident specific information. AlertOps automatically creates an alert when the status variable (inputs^Status) contains 'Ready/Pending/In Progress/Suspended'. The incident will also be closed automatically when the status 'Complete' is received from SMAX.
   1. In Advanced Settings you can define URL mappings as you want in the Rules for Opening and Closing Alerts. You can provide other filters and match with regex expressions as well. You can also test the generated URL with the sample data provided.

Configure Integration in SMAX 

1. A prerequisite for this integration to work is to setup an On-Premise Bridge Agent, Endpoint Credentials for SMAX. Instructions for setting up the agent in Windows can be found in https://docs.microfocus.com/itom/SMAX:2021.08/OpbInstall
2. Once the agent is setup in your system, the service has to be running and endpoint credentials can be setup through the Endpoints Credentials Manager which is an executable file.
3. Once this is done, login to your tenant portal and go to your Agent Interface
4. In the Menu, under Administration and under Utilities select Integration.
5. There is drop-down near the heading Integration Management, select Agents and click '+ Add Agent'. Give a name, description and enable notifications. Select Recipients for the notifications. 
6. An instruction is given in the same window to download a connection file and place it in the folder where you installed your agent and under product/conf. Do the same.
7. Now under the drop-down near the heading Integration Management, select Endpoints.
8. Select 'Add' - give the Endpoint type  as 'Rest Executor 1.0', give an Endpoint name and select Agent which you configured in the previous step. Add
9. Now select that Endpoint that you created and press 'Configure'. Here paste the AlertOps Inbound Integration API URL for Location and for Credentials select the credential that you created using Endpoint Credentials Manager. Save

**If you are able to access the templated AlertOps Package in the Micro Focus ITOM Marketplace (https://marketplace.microfocus.com/itom/category/sma), you can download the package and import it into your SMAX tenant environment. This will add the Studio rule to send updates to AlertOps, however you will need to make changes in it to use your Agent and Endpoint (next set of steps). 

Note that, adding the package would “remove/overwrite” any existing out-of-the-box business processes and Studio rules, and would import what is there in the package, to your environment.

1. To import package, in the main menu, under Administration and under Utilities select 'Packages'. At the top, there is an option near Packages called 'Options. Select that - 'Import a package'. Select the package you downloaded from the marketplace.
2. Now in the Main Menu, under Administration and under Configuration select Studio.
3. Select 'Incident' in the drop-down and go to the 'Process and Rules' tab.
4. On the right side under 'Rules', drop-down the option that says 'After applying changes'. Press the '+Add' button on the right, select 'If...Then rule'. Under Integration Actions, select 'Execute Rest'. Click Ok.
5. This will create a new template with the following configuration,
6. Now in this template select 'OPB Agent Id' and select the Agent you created, select 'OPB Endpoint Id' and select the Endpoint that you created. Do the same for 'Credentials Id'. 
7. Select 'Web Method' as POST, 'URI Suffix' as '/', 'Payload Type' as 'JSON' and for 'Body', paste the following,

${concat('{"runName": "SMAX to AlertOps Get Data - Incident ID: ',entity.Id,'", "logLevel": "STANDARD", "inputs":{"SMAXIncidentID": "',entity.Id,'", "Status": "',entity.Status,'","Priority": "',entity.Priority,'","Name": "',entity.Name,'","Description": "',entity.Description,'","Link": "',entity.Link,'","Source": "',entity.Source,'","CreationTime": "',entity.EmsCreationTime,'","CloseTime": "',entity.CloseTime,'","Category": "',entity.Category,'","AssignedPerson": "',entity.AssignedPerson,'"}}')}

 The 'If' expression should be formatted as the following, 

${entity.Status == 'Ready' || entity.Status == 'Pending' || entity.Status == 'Suspended' || entity.Status == 'Complete' || entity.Status == 'In progress'}

 Your rule should be configured like this,

Once this is done, click the 'Save' button on the top right corner.

Thats it! You have configured an agent, endpoint credential, endpoint and studio rule in SMAX. Any incident event would now send an alert to AlertOps for incident management.

Message logs, alert specific information can be viewed in the “Inbound Log” section in AlertOps Dashboard. Alerts can be viewed in the ‘Alerts’ tab as well.

Alert Triggering Information

AlertOps will automatically create an incident when a new alert is received from SMAX when the inputs^Status field contains "Ready/Pending/In progress/Suspended".

If an alert with status "Ready/Pending/In progress/Suspended" matches an existing Open Alert, AlertOps will recognize the new alert as a duplicate and ignore the alert.

The alert will be recorded in the Inbound Messages table as “Mapped Appended.”

AlertOps will automatically close the same incident when an alert with alert_severity contains "Complete".

References

AlertOps Integration Guides

General Restful API Guide

SMAX OPB Agent Installation

SMAX Rest API

Micro Focus ITOM Marketplace Doc for AlertOps