AIOps

 View Only

Utilising AIOps API to enrich an Incident (via Netcool/Impact policy)

By PATRICK O'NEILL posted Thu January 09, 2025 01:57 PM

  

Objective

CloudPak for AIOps ingests data from many sources and is a central source of truth for an SRE to manage all their disparate systems. A regular requirement from customers is that they need a method to automatically enrich AIOps incidents with data from external systems (state, ticket number, priority etc). This gives more insight for the SRE to manage that incident to a successful conclusion.

This guide is an example procedure to help you get started with that, utilising the experimental AIOps API and a Netcool/Impact policy.

The use case is that an Incident gets created in AIOps. That incident invokes a Netcool/Impact policy which carries out some business logic to generate a ticket/incident in a 3rd party system and then return that data to AIOps, enriching the Incident so that you have a launch in context from AIOps to that external system.

You also have the ability to update other parameters like state and priority if you wish to keep those in sync across the products. This is all done in a fully automated manner.

IMPORTANT: The AIOps API being used is currently experimental so it can change without notice.

Environment

At time of writing (January 2025) the environments used were:

RedHat Openshift v4.14

CloudPak for AIOps v4.8.0

IBM Tivoli Netcool/Impact 7.1.0.34

NOTE: Netcool/Impact is not a prerequisite but was used in this guide as it is a common environment for AIOps customers. You can achieve the same result by invoking the API from your own systems.

Prerequisites

Above environments deployed with the Netcool/Impact integration already configured in AIOps. The Netcool/Impact policy that will be calling the AIOps API will be utilising the Impact DSA that is setup in that procedure as it creates the API key necessary to get access to the AIOps API.

High Level Steps

  • Create Impact policy to enrich AIOps incidents via the API
  • Create AIOps policy to send new AIOps incidents to Impact and invoke the Impact policy

Steps

  • Create Impact policy: From the Netcool/Impact console create a Javascript policy. Example code provided here to get you started.
Log ("Enriching Incident("+EventContainer.incident.id+") with ticket number from external ITSM system");
var dsa='AIOps-jaunpuri1-f243ea05-c344-4d51-9e47-ec7e5031dfea';  // This is the DSA created when you create the Netcool/Impact integration with AIOps
var AIOPS_INCIDENT_PATH = 'api/issue-resolution/v1alpha1/incidents/'; // The experimental API being utilised
var id=EventContainer.incident.id; // The incoming Incident ID from AIOps
var path = AIOPS_INCIDENT_PATH + id;

var permlink='https://github.com/oneill/myproject/issues/1489';  // In practice this would be a function call to get the URL from the external ITSM system
var ticket='1489'; // Like permlink, this would be a function call. Hardcoded here to simplify
var priority=2; // Like permlink. Hardcoded here to simplify.
    
var obj = {
    "priority": priority, 
    "insights": [
        {
        "id": String(JavaCall("java.util.UUID",null,"randomUUID",[])),
        "type": "aiops.ibm.com/insight-type/itsm/metadata",
        "source": "myGithubProject",
        "details": {
           "id": String(JavaCall("java.util.UUID",null,"randomUUID",[])),
           "name": "Github",
           "type": "aiops.ibm.com/insight-type/metadata",
           "permalink": permlink,
           "ticket_num": ticket
        }
      }
    ]
};

result = RESTfulAPIPATCH( dsa, path, { Data: JSON.stringify(obj)}); // Call the experimental API to enrich the AIOps incident
    
Log("Enrich Result: " + result);
if ( result.status > 202 ) {
    throw new Error('Error ' + result.status
                + ' patching incident ' + id
                + '\n' + result.statusText );
}

NOTE: As detailed in the comments in the above policy, some values are hardcoded. In practice you would have your business logic in there to create an external ticket and then pull that URL and ticket number back from your external system and utilise that in the policy. This will be different for each customer depending on what external system you are communicating with. The purpose of this guide is not to explain how to do that but how to push the resultant data into AIOps and to keep the policy simple for the purposes of this example guide.

  • Create AIOps policy: From the AIOps console create a policy to invoke your Impact policy above when new incidents are created in AIOps. Example configuration shown below

Outcome

When new Incidents are created in AIOps they will now automatically invoke your Netcool/Impact policy and you will see the AIOps incident getting updated with the ticket number and any other edits you decided to make to state, priority, owner etc.

Example output seen here on the left of the AIOps incident panel where you can see the data from the Netcool/Impact policy appearing in the main Incident panel in AIOps

NOTE: You can also create additional AIOps policies to invoke additional Netcool/Impact policies when edits are made to the AIOps incident. Example, if you change the priority or state in AIOPs and you want to write that back to the external ticketing system.  That would be achieved by selecting "After an incident has been updated" as below but do be careful not to create an infinite loop of updates by invoking an Impact policy on an update which in turn writes back to the incident which is considered another update and so you get an infinite loop. 

Additional Information

This is a another useful Netcool/Impact code snippet which allows you to pull out all the ITSM metadata from an incoming AIOps incident, which might be useful to you for further processing in Impact.

var insights = EventContainer.incident.insights;

for (var i = 0; i < insights.length; i++) {
  var thisInsight = insights[i];

  if (thisInsight.type === 'aiops.ibm.com/insight-type/itsm/metadata') {
    Log("Insight: "+thisInsight.details.ticket_num);
  }
} 

#Highlights-home
0 comments
22 views

Permalink