This use case provides a message to the responders when an alert is closed by the Integration, after receiving a clear condition from the source system. The workflow will have a one-to-one relationship with the Inbound Integration, as we will explicitly reference the close condition in that Integration.
First, you must create a Custom Alert Field, called SourceStatus, using the Short String data type. You can create this field in the Standard Alert Type, but you must create it in the same Alert Type that is used in the Escalation Rule for your Integration.
Once the Custom Alert Field is created, you need to map it in the Integration. From the Advanced Settings tab of the Inbound Integration, first expand the URL mapping section and note the field mapped to the default SourceStatus field, as well as the value for Close Alert When:
In our example, using a default SolarWinds Integration, the SourceStatus field is mapped to the Status field of the inbound data, and the Value for Close is "Up". Next, expand the Advanced Mapping section below. The Custom Alert Field we created has the same name as the default field, but it will be present in the Advanced Mapping section, which allows us to use it in a Workflow. Enter the same field used above into the Custom Alert Field:
This will populate the Custom Alert Field with the same value used to auto-close the alert. Update the Integration, and proceed to creating the Workflow.
To create a workflow where an email is sent once an alert is closed automatically, begin on the Workflows page and select the Add Workflow button. In the resulting form, enter a Name for the workflow,
in the Type drop down choose MessageThread,
Set the Alert Type to the same one where we created the Custom Alert Field,
Save Changes.
We now have fields for Start Conditions and Actions. Add a Start Condition, for this example we will use Match All Conditions. In the dropdown for Name, select MessageThreadStatusType:
Select Closed as the Value and press the green checkmark:
Add another Start Condition under Match All. This time, select the Attribute drop down and choose Custom. In the Name drop down, choose our Custom Field, SourceStatus. Set the Value to Up, and press the green checkmark.
Under Actions, select Add Action, then select SendMessage, this will produce a dialog box:
Select (or create) a Escalation Rule to govern the routing of the update message, then choose the recipient. In this scenario, we want to notify the Original Recipients, so we will check that box.
In the Message Text box, you can craft the body of the message using static text and/or keywords from the list. The example above will state the name of the Integration (as shown in the Source field of the Integration) using the keyword from the list. Save the changes to the Action, and this will update the Workflow. Finally, ensure the new Workflow is Enabled (select the button in the top right corner of the page).
To add the Workflow to the Escalation Rule, select Escalation Rules from the menu, choose your Escalation Rule and select the Workflows tab:
Note that the Escalation Rule for the Action must be independent of the Escalation Rule this Workflow is applied to (e.g. This Workflow cannot be applied to the “Email msg on alert update” rule, as that rule was chosen to govern the delivery of the update within the Workflow). Any Escalation Rule already used in a Workflow cannot have additional Workflows applied, and the Add Workflow button will be greyed out.
Press the Add Workflow button. In the resulting dialog, select your Workflow (it must be enabled to be present here) and press the arrow button to move it to the Selected Workflows list:
Press Update and the new Workflow is added to the Escalation Rule and saved.
Now, when the Integration closes the alert, the original responders will receive the following message:
