Managing First Response Policy

Introduction

First response policy allows you to auto-suppress alerts as a first response mechanism for frequent and unnecessary alerts.

Prerequisites

You must have OpsQ View and OpsQ Manage permissions to access First Response Policy.

Creating first response policies

To create a first response policy:

1. From All Clients, select a client.
2. Go to Setup > Alerts > First Response.
3. Click Add button to create a first response policy.
4. Provide a unique name for the policy.
5. Select one of the modes from the Mode drop-down menu.
6. From the Filter Criteria section, select resources whose alerts match this policy.
   
   1. Choose from Any or All of the defined conditions to apply as filter for the alerts.
      
   2. Select Native Attributes to use the available attributes that are predefined in OpsRamp.
      
   3. Select Custom Attributes to filter the alerts based on specific custom attributes of a client or a resource.
      
   4. From attributes drop-down list, select required attribute.
      
   5. From Operators drop-down list, select required Operator and provide the values.
7. From Policy Definition section, define conditions for suppressing alerts.
   
   1. Upload a training file if you select Suppress specific alerts and Snooze specific alerts options.
      The training file must include examples of alerts that need to be suppressed.
      
   2. Click Drop the training data file here, or browse to upload a CSV file.
      Note: One client can upload only one training file. Changing the training file affects all learned policies of the client.
   3. Select the file from your local folder. On uploading the file Input and Output columns appear.
   4. Validate the Input and Output columns.
      

      

   5. Click Continue to Model Training.
      Input and Output columns appear.
      
   6. Click Train Model. The accuracy of the trained First Response policy appears in the Summary section.
   7. Click Review.
      • Review the summary from the Attribute Based configuration.
      • To modify the configuration, click Edit.
        

        

8. Click Save.

The first response policy is created and appears on the First Response Policies page.

Editing policies

To modify the details of existing first response policy:

1. Click on the policy name.
2. From the policy page, click Edit.
3. From EDIT FIRST RESPONSE POLICY, edit the details as required.
4. Click Save.

Deleting policies

To delete a policy that is no longer used:

1. Select the check box adjacent to the policy and then click Delete.
2. Click Yes on the confirmation window. The policy is deleted from the First Response Policies List.

Creating copies

To create a new policy using the details of an existing policy:

1. From the First Response Policies page, select the check box adjacent to the policy and click the copy icon. The NEW FIRST RESPONSE POLICY page is displayed with the main policy details.
2. Provide a unique name for the policy.
3. Modify the details as required.
4. Click Save.
   The new policy is created and displayed under First Response Policies List section.