Moogsoft Incidents

To add a Moosoft step to your flow:

1.  Go to the Apps tab of the palette, expand the Moogsoft section, and drag the step onto the canvas.
   • For instructions on using the Moogsoft Incidents trigger, see Moogsoft Incidents trigger.
2. Connect the step to the previous step in the flow. This gives you access to the alert properties and outputs of previous steps when you configure this step's inputs.
3. Double-click the step to edit it, and use the Setup tab to configure the inputs. You can use plain text and input variables (or both). See the following section for detailed information on the inputs, including which are required.
4. On the Endpoint tab, configure the step to point to your Moogsoft instance.
   • You can select a pre-existing endpoint or configure a new endpoint with the following information:
     • Name: Type a name that will identify your endpoint.
     • Base URL: Enter https://api.moogsoft.ai.
     • Endpoint Type: Select 'Token' (selected by default).
     • Header: Select 'Custom'.
     • Token Header: Type 'apikey'.
     • Token: Enter your organization's Moogsoft API key.
     • ID Header: Leave blank.
     • ID: Leave blank.

1. In Moogsoft, go to Integrations > Outbound Integrations and select Webhook from the menu.

   

2. Click Add a Webhook.

   

3. In the Name and Scope section fill in the following fields:
   • Name: Give the webhook a name (for example, xMatters).
   • Type: Select Incident from the drop-down menu.

     

4. In the CREATE Operation and HTTP Configuration section fill in the following fields:
   • Request Method: Select POST from the drop-down menu.
   • URL: Paste the trigger URL you copied from Flow Designer. Add the target names of any recipients you want to notify when the alert fires.
     • For URL authentication, use an ampersand to attach recipients. For example, if you want to notify Emma Pearson and the on-call members in the group responsible for the Antares service, you'd add &recipients=epearson,antares to the URL.
     • For other authentication types, use a question mark to attach recipients. For example, if you want to notify Barry Gull and the on-call members in the group responsible for the Cassiopeia service, you'd add ?recipients=bgull,cassiopeia to the URL.
     • You must URL-encode any special characters or spaces in the target names.

   

5. In the Payload Body for CREATE Operation section, set the payload as:
   Copy

   {
   "timestamp": "$created_at",
   "location": "$tags.region",
   "severity": "$severity",
   "id": "$id",
   "description": "$description",
   "services": $services,
   "status": "$status",
   "totalalerts": "$total_alerts",
   "signalMode": "New",
   "assignee": "$assignee",
   "correlationDefinition": "$correlation_definition",
   "incidentURL": "$incident_url"
   }
   

6. In the UPDATE notifications section fill in the following fields:
   • Turn on the Enable update notifications toggle.
   • Request Method: Select POST from the drop-down menu.
   • URL: Paste the trigger URL you copied from Flow Designer. Add the target names of any recipients you want to notify when the alert fires.
     • For URL authentication, use an ampersand to attach recipients. For example, if you want to notify Emma Pearson and the on-call members in the group responsible for the Antares service, you'd add &recipients=epearson,antares to the URL.
     • For other authentication types, use a question mark to attach recipients. For example, if you want to notify Barry Gull and the on-call members in the group responsible for the Cassiopeia service, you'd add ?recipients=bgull,cassiopeia to the URL.
     • You must URL-encode any special characters or spaces in the target names.
   • Triggers: turn on the toggles for type of updates you'd like to receive notifications for.

   

7. In the Payload Body for UPDATE Operation section, set the payload as:
   Copy

   {
   "timestamp": "$created_at",
   "location": "$tags.region",
   "severity": "$severity",
   "id": "$id",
   "description": "$description",
   "services": $services,
   "status": "$status",
   "totalalerts": "$total_alerts",
   "signalMode": "Update",
   "assignee": "$assignee",
   "correlationDefinition": "$correlation_definition",
   "incidentURL": "$incident_url"
   }
   

8. Optional: To test the webhook, go to the top of the Outbound Webhook page and click Test.

   

9. Click Save.

You're ready to use the webhook to trigger automated flows, including steps such as sending alerts and initiating incidents, though we always recommend testing before putting things into use. To keep things tidy in Moogsoft, we recommend using the Correlation Engine to combine similar incoming alerts into Moogsoft incidents.

Configure Correlation Engine

1. In Moogsoft go to Correlate & Automate > Correlation Engine.

   

2. Click Add Correlation Definition.

   

3. In the Construct Your Incident Description section fill in the following fields:
   • Correlation Name: Give the correlation a unique name.
   • Incident Description: Set the correlation description. The description displays for all incidents created by this correlation definition.

   

4. In the Definition section, set the Scope of the correlation to match all alerts or only alerts that match the filter parameters, then click Add Field.

   

5. Optional: In the Advanced section you can set duration for the Correlation Time Window and select the minimum number of similar alerts before an incident is created.

   

6. Click Save.

The correlation engine will create Moogsoft incidents from the incoming alerts based on your configuration settings.

The trigger has the following outputs you can use as inputs to steps further along the flow.