Event Automation

This chapter explains how the AME Event automation works for Rules and Notifications.

The following image shows how AME turns Splunk alerts into events. Events can trigger rules and notifications.

Automation Flow

1. An Alert gets triggered and creates or updates an Event
2. The event triggers the rule engine. If a rule is found and all conditions are fulfilled the event gets updated
3. (Optional) If a keyword is defined, the keyword is also written into the Notification Queue.
4. The event is updated, and a copy of the event data is written into the Notification Queue.
5. The Notification Engine tracks the notification queue
6. If a matching flow is found, the Notification Queue is updated with information about targets (channels) to be notified
7. A worker process is sending Notifications to the specified targets.

Rule Engine Field Reference

Besides event data fields, the Rule Engine has following event metadata available to use for conditions:

Field Name	Description	Type	Example
ame.assignee	The current assignee of the an event	String	admin
ame.count	The duplicate count	Integer	1
ame.event_title	The event title	String	Alert for host xyz
ame.event_ttl	The event TTL	Integer	600
ame.first_seen	The first seen timestamp	Integer	1711401172
ame.impact	Event impact	String	low
ame.most_recent	The most recent timestamp	Integer	1711401172
ame.notifications	The notification UID	String	63d76e6be87c1840f142114
ame.notable_fields	The notable fields	Stringlist	src_ip,dest_ip,count
ame.priority	Event priority value	Integer	1
ame.priority_name	The priority name	String	low
ame.resolution	The resolution UID	String	63d76e6be87c1840f142114
ame.resolution_name	The resolution	String	True positive
ame.search_name	The name of the saved search	String	myalert
ame.status	The status UID of the event	String	63d76e6be87c1840f142114
ame.status_name	The status name	String	in_progress
ame.tenant_uid	The name of the tenant	String	default
ame.template	The template UID	String	63d76e6be87c1840f142114
ame.template_name	The template name	String	default
ame.ttl_target	The next status for the event	String	resolved
ame.urgency	Event urgency	String	low

Notification Engine Field Reference

Besides event data fields, the Notification Engine has the following event metadata available to use for conditions:

Field Name	Description	Type	Example
ame.assignee	The current assignee of the an event	String	admin
ame.count	The duplicate count	Integer	1
ame.event_title	The event title	String	Alert for host xyz
ame.event_ttl	The event TTL	Integer	600
ame.first_seen	The first seen timestamp	Integer	1711401172
ame.impact	Event impact	String	low
ame.most_recent	The most recent timestamp	Integer	1711401172
ame.notifications	The notification UID	String	63d76e6be87c1840f142114
ame.notable_fields	The notable fields	Stringlist	src_ip,dest_ip,count
ame.priority	Event priority value	Integer	1
ame.priority_name	The priority name	String	low
ame.resolution	The resolution UID	String	63d76e6be87c1840f142114
ame.resolution_name	The resolution	String	True positive
ame.search_name	The name of the saved search	String	myalert
ame.status	The status UID of the event	String	63d76e6be87c1840f142114
ame.status_name	The status name	String	in_progress
ame.tenant_uid	The name of the tenant	String	default
ame.template	The template UID	String	63d76e6be87c1840f142114
ame.template_name	The template name	String	default
ame.ttl_target	The next status for the event	String	resolved
ame.urgency	Event urgency	String	low

Additionally, trigger condition fields are available:

Field Name	Description	Type	Example
changed	The field that has changed	Stringlist	ame.status_name,ame.assignee
values	The value of the field that has changed	Stringlist	new,admin
keyword	A keyword that is passed from a rule	Stringlist	mykeyword