Synthetic Rules - Active & recovered states - Incident Create & update

Elastic Observability
1

Hi,

I am trying to capture ‘Active & Recovered ‘ events for a synthetic monitor so that i can update Incident in SNOW now.

Setup: Have synthetic monioring setup for a website. Have a syntheric & uptime rule setup. Have SNOW ITSM connector setup.

Goal: When DOWN alert is triggered, would like to create an Incident in SNOW using ITSM connector. And when item is recovered want the same Incident just updated with “recovered” status to reflect status accurately.

Having a hard time capturing active & recovered events & hence unable to do create/update of Incident in SNOW.

Appreciate any help with this

2

Hey @c.m!

To auto-recover the ServiceNow incident when the monitor rule recovers previously fired alerts, you can use a dedicated rule action. Open the rule(s) you have associated to the monitor (go to Synthetics > Monitors, then from the Alerts dropdown menu in the top right toolbar, select Monitor status rule > Create or Edit default rule). In the rule settings, you’ll see the action you likely already configured to propagate the alert to ServiceNow. Add another similar action using the same ServiceNow connector, but from the Settings tab select Run when: Recovered.

image
image1768×1412 180 KB

You’ll see that the action Message tab will change only showing the correlation id it uses to resolve the previously created incident.