[📃 Docs]: disposable and enrich alert in trigger interval or manual (from workflow page) or incident

[00041275]

My question is in the context of enrichment in the resolve_old_alert case

1. what does disposable true do?
2. how does the enrichment rule work if you don't have an alert in the trigger?
3. can I call subprocess in trigger interval or other with sending variables (for queried alerts in keep) ??

I currently have a case with zabbix, when I get data from it, but I don't know about resolving data. In an attempt to poll it again, I want to write updated data to alert for scope in trigger interval or manual (from workflow page) or incident. How I can poll and enrich using a trigger?

id: resolve-old-alerts
description: '-'
disabled: true
triggers:
- type: manual
- type: interval
  value: 60
consts: {}
name: resolve-old-alerts
owners: []
services: []
steps:
- name: get-alerts
  provider:
    config: '{{ providers.default-keep }}'
    type: keep
    with:
      filter: status == 'firing'
      version: 2
actions:
- foreach: ' {{ steps.get-alerts.results }} '
  if: keep.to_timestamp('{{ foreach.value.lastReceived }}') < keep.utcnowtimestamp() - 3600
  name: resolve-alerts
  provider:
    config: '{{ providers.default-mock }}'
    type: mock
    with:
      enrich_alert:
      - disposable: true
        key: status
        value: resolved

[dosubot]

1. The disposable attribute in an enrichment rule determines whether the enrichment is temporary and should be discarded when a new alert is received. If disposable is set to True, the enrichment is added to disposable_enrichments and marked with dispose_on_new_alert=True. This means the enrichment will not persist beyond the current alert and will be removed when a new alert is processed ^[1][2].

2. If there is no alert present in the trigger, the enrichment rule would not have an alert to apply to. The enrichment process typically requires an alert to be present to apply the specified enrichments. Without an alert, the enrichment rule would not execute as intended.

3. Regarding calling subprocesses within a trigger interval and passing variables, the documentation does not provide specific details on this capability. However, Keep's workflow system allows for manual triggers and interval-based triggers, which can be configured to perform actions like polling and enriching alerts. You might need to explore custom implementations or consult further documentation for subprocess handling and variable passing.

For your case with Zabbix, you can use the interval trigger to poll data at regular intervals and enrich alerts based on the retrieved data. The workflow you provided uses a manual and interval trigger to resolve old alerts by checking their status and updating them if they meet certain conditions. You can adapt this approach to poll and enrich alerts using the specified triggers.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Other}

[00041275]

@shahargl can you answer for question
In case for interval, enrichment work if object have variable "fingerprint". So if I want enrich alert with provider data I need get data from keep alerts, then get data from some provider, then create list[dict] may be in python provider where I merge alert data and provider data (and variable "fingerprint" is requirement for 1st lvl). Is it right?

for example

steps:

• get-alerts-from-keep
• get-external-data-from-some-provider
• transform_data_in_provider with result [ { "alert": {keep alert info}, "fingerprint": "asdsdfrege4324t3", "external_data": {data from provider} } ]

actions:
- foreach: ' {{ steps.transform_data_in_provider.results }} '
  if: {{ foreach.value.external_data.good }} == true
  name: resolve-alerts
  provider:
    config: '{{ providers.default-mock }}'
    type: mock
    with:
      enrich_alert:
      - disposable: true
        key: status
        value: resolved
      - key: external_data
        value: some_enrichment

[00041275]

@shahargl can you answer for question In case for interval, enrichment work if object have variable "fingerprint". So if I want enrich alert with provider data I need get data from keep alerts, then get data from some provider, then create list[dict] may be in python provider where I merge alert data and provider data (and variable "fingerprint" is requirement for 1st lvl). Is it right?

for example

steps:

• get-alerts-from-keep
• get-external-data-from-some-provider
• transform_data_in_provider with result [ { "alert": {keep alert info}, "fingerprint": "asdsdfrege4324t3", "external_data": {data from provider} } ]

actions:
- foreach: ' {{ steps.transform_data_in_provider.results }} '
  if: {{ foreach.value.external_data.good }} == true
  name: resolve-alerts
  provider:
    config: '{{ providers.default-mock }}'
    type: mock
    with:
      enrich_alert:
      - disposable: true
        key: status
        value: resolved
      - key: external_data
        value: some_enrichment

@talboren please look for this, is it right?

[talboren]

@00041275 this is true. If the result object will have fingerprint, we will use that for enrichment.

[00041275]

Это действительно так. Если результирующий объект будет иметь отпечаток, мы будем использовать его для обогащения.

I think we need add this to doc

[talboren]

@00041275 would you care adding it?

[00041275]

@00041275 would you care adding it?

added for header "Enrichment without an Alert/Incident" text : A workaround is to use a foreach directive and pass it an object containing the "fingerprint" variable.